Crafty Controller: Stored cross-site scripting in Activity Logs
Summary
Crafty Controller, a web panel for managing Minecraft game servers, stores the client-supplied X-Real-IP or X-Forwarded-For header in its audit log when a login fails for an existing user. The Activity Logs page inserts these stored values into the page as HTML. An unauthenticated remote attacker can therefore plant script code that runs in the browser of a superuser who opens Activity Logs, with that user's rights. According to the reporter, this can be chained to command execution on the server; this chain is not confirmed by the CNA record.
Affected
- Crafty Controller 0 to 4.10.8 (per CNA record).
Fixed in
- Upgrade to version 4.11.0 or later (per CNA record; verify against the vendor release notes).
Workaround
- No vendor workaround published.
- Only expose Crafty behind a reverse proxy that overwrites or strips X-Real-IP and X-Forwarded-For.
- Do not expose the panel directly to the internet; restrict access by VPN or IP allowlist.
- Limit superuser accounts and avoid opening Activity Logs until the upgrade is done.
Exploitation
- No exploitation in the wild reported.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Public technical details are available in the GitLab issue. EPSS 0.00291.
Our recommendation
- Upgrade Crafty Controller to 4.11.0 or later.
- Until then, do not expose the panel to the internet and restrict access to trusted networks.
- Check whether forwarding headers can reach Crafty and whether reverse proxies strip them.
- Review the audit log for entries containing HTML or script content, and review superuser accounts.
- Keep Crafty Controller on the current release line.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitLab issue #743 (reporter, technical details) gitlab.com
- VulDB entry 421288 vuldb.com
- Strix AI CVE overview CVE-2026-18516 www.strix.ai
- SecurityFocus CVE-2026-18516 www.securityfocus.com
- Vulners PT-2026-115610 (EPSS) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 22:46.
Original description (NVD)
An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.