CVE-2025-14700 - CVE House

Status published Critical CVE-2025-14700

Improper Neutralization of Special Elements Used in a Template Engine in Crafty Controller

9.9 CVSS

Vulnerability Description

An input neutralization vulnerability in the Webhook Template component of Crafty Controller allows a remote, authenticated attacker to perform remote code execution via Server Side Template Injection.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-14700

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Thank you to [Rozza / rchar](https://gitlab.com/rchar) on GitLab for reporting this issue.

References

https://gitlab.com/crafty-controller/crafty-4/-/issues/646

More from Arcadia Technology, LLC

View All →

CVE-2025-5990

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller

High 7.6

CVE-2025-14701

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller

High 7.1

CVE-2024-1064

Improper Neutralization of HTTP Headers for Scripting Syntax in Crafty Controller 4

High 7.5

Affected Vendor

Arcadia Technology, LLC

View all reports →

Affected Software

Crafty Controller

Vulnerable Versions:

4.6.1

Timeline

Official Publish: December 17th, 2025

Last Modified: December 17th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-1336

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.