Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
Arcadia Technology, LLC Crafty Controller — Path Traversal: '.../...//' in Crafty Controller
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L L N C L H L 9.1 .0058 45.1 —
AFFECTED
Product Versions Fixed
Crafty Controller 4.4.0 – —
TIMELINE
Jun 29 Reserved by GitLab
Aug 11 EXPLOIT PUBLISHED — CVE-2026-13716 (Arcadia Technology, LLC Crafty Controller). Public exploit reference added.
Aug 11 Published (CNA: GitLab)
Description
Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| June 29, 2026 | Reserved | Reserved by GitLab |
| August 11, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-13716 (Arcadia Technology, LLC Crafty Controller). Public exploit reference added. |
| August 11, 2026 | Published | Published (CNA: GitLab) |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| Arcadia Technology, LLC | Crafty Controller | — | 4.4.0 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-13716 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.