CVE-2026-18516

Published: Oct 16, 2026Modified: Oct 18, 2026Deferred

9.6

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 6.0

Source: cve@gitlab.com (Secondary)

Description

An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection

Related CWEs

CWE-116

Improper Encoding or Escaping of Output

The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

References (1)

https://gitlab.com/crafty-controller/crafty-4/-/work_items/743

Source: cve@gitlab.com

Timeline

No history available yet.