What is GHSA-gj28-gw7w-3pxc?

GHSA-gj28-gw7w-3pxc is a security advisory published by GitHub Security Advisories with Medium severity. Crafter CMS has Improper Control of Dynamically-Managed Code Resources

Which CVE IDs does GHSA-gj28-gw7w-3pxc cover?

GHSA-gj28-gw7w-3pxc covers the following CVE IDs: CVE-2026-1770. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-gj28-gw7w-3pxc?

GHSA-gj28-gw7w-3pxc affects 1 product, including: maven/org.craftercms:craftercms:\u003e= 4.0.0, \u003c 4.5.0.

GHSA-gj28-gw7w-3pxcMedium

Crafter CMS has Improper Control of Dynamically-Managed Code Resources

Vendor

GitHub Security Advisories

Published

February 2, 2026

Last Modified

February 2, 2026

🔗 CVE IDs covered (1)

CVE-2026-1770 →

📋 Description

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass sandbox restrictions and obtain RCE (Remote Code Execution).

🎯 Affected products1

maven/org.craftercms:craftercms:>= 4.0.0, < 4.5.0

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-1770
https://docs.craftercms.org/current/security/advisory.html#cv-2026020201
https://github.com/advisories/GHSA-gj28-gw7w-3pxc