CVE-2025-6384

Published: Jun 19, 2025

Modified: Jun 23, 2025

PUBLISHED

Description

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass Sandbox restrictions and obtain RCE (Remote Code Execution). This issue affects CrafterCMS: from 4.0.0 through 4.2.2.

Vendor	Product	Versions
CrafterCMS	CrafterCMS	affected `4.0.0 - < 4.3.0`

Weaknesses (CWE)

CWE-913

References

https://docs.craftercms.org/current/security/advisory.html#cv-2025061901

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2025-6384

Description

Affected Products

Weaknesses (CWE)

References