The vulnerability is an input neutralization flaw in the File Operations API endpoint of Crafty Controller that permits a remote, authenticated attacker to manipulate file paths. The flaw allows the attacker to perform path traversal, leading to file tampering and potentially remote code execution. This is a classic directory traversal weakness identified as CWE‑22 and provides an attacker with the ability to read, write, or execute files beyond the intended directory.

Arcadia Technology, LLC’s Crafty Controller version 4.7.0 is affected. Users running this version or any earlier release that has not applied the vendor‑published fix are vulnerable. No other affected versions were disclosed in the current data.

This flaw carries a CVSS score of 9.9, indicating critical severity. The EPSS score is reported as less than 1 %, suggesting a low probability of exploitation at present, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector requires a remote authenticated connection to the File Operations API endpoint. Once authenticated, an attacker can supply crafted file path input that traverses outside the intended directory, enabling tampering with system files and execution of arbitrary code on the host.