CrafterCMS Crafter Studio Improperly Controls Dynamically-Managed Code Resources

HIGH 7.2CVE-2022-40634 · GHSA-2jv3-v37p-65w3 · Published 13/09/2022 · updated 17/06/2026

In short

CVE-2022-40634 is a HIGH (CVSS 7.2) vulnerability affecting org.craftercms:crafter-studio, crafter cms (craftercms).
Chance of exploitation in the next 30 days (EPSS): 1.6%, higher than 75.6% of all vulnerabilities.
Fix: update to 3.1.23 or later.

Package	Affected versions	Patched versions
org.craftercms:crafter-studio Maven	`≥ 3.1.0, < 3.1.23`	`3.1.23`
crafter cms craftercms	`≥ 3.1.0, < 3.1.23`	`3.1.23`

Description

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker SSTI.

NVD description

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker SSTI.

References

nvd.nist.gov/vuln/detail/CVE-2022-40634 · ADVISORY
docs.craftercms.org/en/3.1/security/advisory.html · WEB
craftercms/studio · PACKAGE

More vulnerabilities in org.craftercms:crafter-studio

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.craftercms:crafter-studio

Maven

≥ 3.1.0, < 3.1.23

3.1.23

crafter cms

craftercms

≥ 3.1.0, < 3.1.23

3.1.23

Description

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker SSTI.

NVD description

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker SSTI.

More vulnerabilities in org.craftercms:crafter-studio

See all →