4.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-1770

CVE-2026-1770: Improper Control of Dynamically-Managed Code Resources in Crafter Studio

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass sandbox restrictions and obtain RCE (Remote Code Execution).

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-1770

CVE-2026-1770:

4.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.craftercms:craftercms	maven	>= 4.0.0, < 4.5.0	4.5.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Groovy Sandbox Bypass in Crafter CMS, which allows authenticated developers to execute OS commands. The analysis of the commits between the vulnerable version and the patched version revealed that the patch consists of adding a whitelist for the Groovy sandbox. The key commit 8ee112618df79ab40c01d5e5f198ae4500cdcd8b introduces configuration properties (studio.scripting.sandbox.whitelist.path and crafter.engine.groovy.sandbox.whitelist.path) to specify the location of these whitelists.

By searching for the usage of these properties in the codebase, I identified the classes responsible for script execution and sandbox configuration. The org.craftercms.studio.impl.v1.service.script.ScriptingServiceImpl class in Crafter Studio uses the studio.scripting.sandbox.whitelist.path property, and its runScript method is the entry point for executing user-provided scripts. Similarly, the org.craftercms.engine.service.impl.GroovyScriptingServiceImpl class in Crafter Engine uses the crafter.engine.groovy.sandbox.whitelist.path property in its createSandbox method to configure the sandbox.

Before the patch, these services did not enforce a sufficiently restrictive whitelist, allowing malicious Groovy code to bypass the sandbox and achieve remote code execution. Therefore, the runScript and createSandbox methods are the primary vulnerable functions that would appear in a runtime profile during exploitation.

Vulnerable functions

org.craftercms.studio.impl.v1.service.script.ScriptingServiceImpl.runScript

modules/studio/impl/src/main/java/org/craftercms/studio/impl/v1/service/script/ScriptingServiceImpl.java

The `runScript` method in `ScriptingServiceImpl` is responsible for executing Groovy scripts within Crafter Studio. Before the patch, the Groovy sandbox was not configured with a sufficiently restrictive whitelist, allowing authenticated developers to execute arbitrary OS commands by bypassing the sandbox. The vulnerability is exploited by crafting a malicious Groovy script and executing it through this method.

org.craftercms.engine.service.impl.GroovyScriptingServiceImpl.createSandbox

modules/engine/src/main/java/org/craftercms/engine/service/impl/GroovyScriptingServiceImpl.java

The `createSandbox` method in `GroovyScriptingServiceImpl` is responsible for creating and configuring the Groovy sandbox for script execution in Crafter Engine. Prior to the patch, this method did not enforce a strict whitelist of allowed methods and classes, which could be exploited to bypass the sandbox and execute arbitrary code. The patch introduces a configurable whitelist to mitigate this.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.