{"id":"CVE-2026-18516","title":"Improper Encoding or Escaping of Output in Crafty Controller","summary":"An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection","severity":"critical","cvss":9.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-116"],"vendor":"Arcadia Technology, LLC","product":"Crafty Controller","affected":["crafty_controller <= 4.10.8"],"published":"2026-10-16","updated":"2026-10-16","sourceUpdated":"2026-10-16T13:37:55.079Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-18516","references":[{"url":"https://gitlab.com/crafty-controller/crafty-4/-/work_items/743"}],"tags":["cve.org"],"ingestedAt":"2026-10-16T14:07:42.843Z","slug":"CVE-2026-18516","body":"## Overview\n\nAn output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection\n\n## Affected\n\n- `crafty_controller <= 4.10.8`\n\n## Remediation\n\nUpgrade to version 4.11.0 or make Crafty Controller only accessible behind a reverse proxy that blocks injection of the X-Real-IP and X-Forwarded-For headers","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":52.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}