TL;DR: CVE-2026-13716 is a critical path traversal vulnerability (CVSS 9.1) in Crafty Controller, a Minecraft server management panel. A remote, authenticated attacker can abuse the server import and admin file upload features to write files to arbitrary paths on the host. That write primitive becomes full remote code execution. No fix is available yet.

The attack chain

The vulnerability lives in two features of Crafty Controller: the server import function and the admin file upload handler. Both accept file paths from user input without confining them to an intended directory. An attacker with a low-privilege authenticated session, the kind any Minecraft server moderator or staff member might hold, can craft an upload request using ../../ sequences to traverse out of the intended upload directory.

The traversal succeeds because the application resolves the user-supplied path without checking the canonical result. A request that starts in /servers/myserver/uploads/ can reach ../../../../etc/systemd/system/malicious.service or any other location writable by the Crafty Controller process. Once a payload lands in a location the system will execute, the attacker has code running on the host.

The CVSS 3.1 vector confirms the severity: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L. Network-exploitable, low complexity, no user interaction, and the scope changes because the escape crosses from the application into the underlying OS. The high integrity impact means the attacker can modify or replace system files. This is not a theoretical exploit. The primitives are straightforward.

How CVE-2026-13716 was reported

The vulnerability was disclosed via GitLab on August 11, 2026. Two work items track the issue: one for the server import path traversal and one for the admin file upload path traversal. Both are in the Crafty Controller 4 repository under the crafty-controller group on GitLab. The CVE record lists both work items as references.

What Crafty Controller is and who uses it

Crafty Controller is an open-source Minecraft server management panel built in Python. Arcadia Technology develops and maintains it under a GPL-3.0 license. It provides a web interface for launching Minecraft servers, managing players, running commands, editing server files, and taking backups. The project targets self-hosters who want a simpler alternative to Pterodactyl for managing Minecraft Java and Bedrock servers from a single container.

The install base is modest but engaged. According to the official Crafty Controller website and a March 2026 review, the panel has approximately 22,500 Linux installs, 10,300 Windows installs, and 14,200 CasaOS installs. The Discord community has roughly 14,800 members. The GitLab repository shows 214 stars. For a Minecraft-specific tool, that is a meaningful deployment footprint. These are homelab operators, small community server hosts, and Minecraft server admins running on their own hardware or VPS instances.

Who is affected

Any Crafty Controller deployment where untrusted users have authenticated access is at risk. The vulnerability requires authentication, but the privilege level is low. Any user who can access the server import or file upload features can exploit this. In practice, that means any Minecraft server staff member, not just full administrators.

Deployments exposed to the public internet are at highest risk. Crafty Controller runs locally by default, but many operators port-forward the web panel for remote access. An exposed panel with this vulnerability gives an attacker a direct path from web login to host-level code execution.

The affectedPackages field lists Crafty Controller by Arcadia Technology, LLC with no fixed versions. Every current version is affected.

What to do

No patched version is available yet. Until Arcadia Technology releases a fix, take these steps:

• Restrict network exposure: Do not expose the Crafty Controller web panel to the public internet. If you need remote access, use a VPN or an SSH tunnel instead of port-forwarding the panel.
• Audit user accounts: Review who has authenticated access to your Crafty Controller instance. Remove accounts that do not need server import or file upload permissions.
• Run Crafty in a container: If you are not already using Docker, switch to the container deployment. A container limits the blast radius of a path traversal escape by restricting the filesystem the process can reach.
• Monitor for suspicious uploads: Watch for files appearing outside expected upload directories. The attack writes to arbitrary paths, so unexpected files in /etc/, /tmp/, or systemd service directories are strong indicators of exploitation.
• Filesystem permissions: Run the Crafty Controller process as a dedicated user with minimal write permissions. The traversal can only write to paths the process user can access.

Track the GitLab work items for the fix: work item 727 and work item 740. Patch as soon as a fixed version ships.

Why it matters

A CVSS 9.1 critical vulnerability in a server management panel is serious. The panel itself runs with enough privileges to manage game servers, and a path traversal escape turns that into full host compromise. For homelab operators running Crafty Controller on a shared machine, this vulnerability can reach beyond the Minecraft server into everything else on that host. The fact that no fix exists yet makes this an active exposure today.

References

• NVD: CVE-2026-13716
• HOL Guard: CVE-2026-13716
• GitLab Work Item 727 (server import)
• GitLab Work Item 740 (file upload)
• Crafty Controller 4 Repository