An authentication‑controlled flaw in Crafter Studio allows the injection of malicious Groovy code that bypasses the sandbox, enabling the attacker to run arbitrary operating‑system commands. The weakness maps to CWE‑913, Improper Control of Dynamically‑Managed Code Resources. As a result, a compromised developer account can compromise the entire system, exposing all confidential data and potentially disrupting availability.

CrafterCMS, specifically the CrafterCMS Studio module. No explicit version range is listed, so all releases containing the affected studio component are potentially impacted.

The CVSS score of 4.5 describes moderate severity, and the EPSS score of less than 1% indicates a low probability of widespread exploitation. The flaw does not appear on the KEV catalog. Exploitation requires valid developer credentials and the ability to insert Groovy elements, so the vector is limited to authenticated insiders or attackers who have gained such access. If successful, the attacker would gain full control over the underlying operating system.