CVE-2021-23267: Improper Control of Dynamically-Managed Code Resources in Crafter CMS
Summary
CVE-2021-23267: Crafter CMS Crafter Studio vulnerable to Improper Control of Dynamically-Managed Code Resources. Affects org.craftercms:crafter-studio versions >= 3.1.0, < 3.1.18. Fixed in 3.1.18. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Crafter CMS is an open-source content management system that allows developers to create, manage, and publish digital content. It provides a flexible and extensible platform for building websites, applications, and other digital experiences. The vulnerability in Crafter Studio, a component of Crafter CMS, allows authenticated developers to execute operating system commands through FreeMarker static methods.
Vulnerability Detail
The vulnerability arises from an improper control of dynamically-managed code resources in Crafter Studio. Authenticated developers can exploit this vulnerability to execute arbitrary operating system commands. This can lead to unauthorized access, data breaches, and potential compromise of the entire system. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Latest published version: 4.3.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.1.18
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the latest version of Crafter CMS.
Conclusion
The vulnerability in Crafter CMS allows authenticated developers to execute operating system commands, posing a significant security risk. It is crucial to upgrade to the latest version of Crafter CMS to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.craftercms:crafter-studio →
FAQ
Crafter CMS is an open-source content management system that enables developers to create, manage, and publish digital content.
The vulnerability allows authenticated developers to execute operating system commands, potentially leading to unauthorized access, data breaches, and system compromise.
To fix this vulnerability, upgrade your Crafter CMS installation to version 3.1.18 or later.
No, there is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to the latest version of Crafter CMS.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.craftercms:crafter-studio.
