CVE-2025-0502 is a critical (9.1) resource leak flaw in CrafterCMS Engine that allows directory indexing. It affects 4.0.0 before 4.0.8 and 4.1.0 before 4.1.6. Upgrade to 4.0.8, 4.1.6 or later, which are the fixed releases named by the vendor, and review what Engine can list on your delivery site.
What's affected
The record and the vendor's advisory CV-2025011501, dated 2025.01.15, list two affected ranges: from 4.0.0 before 4.0.8, and from 4.1.0 before 4.1.6. The fixed releases are therefore 4.0.8 and 4.1.6, and anything newer in those lines.
The component is CrafterCMS Engine, the delivery side of the platform that serves content to visitors. The weakness is CWE-402, transmission of private resources into a new sphere, also called a resource leak. The advisory maps the impact to two attack patterns, directory indexing and resource leak exposure. In plain terms, Engine could show a listing of files or folders, and expose resources that were meant to stay private.
The advisory rates the risk as medium, while the CVSS base score in the record is 9.1. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H: a network attack, low complexity, no privileges and no user interaction, with high confidentiality impact, no integrity impact and high availability impact. The two ratings differ, so use the CVSS number to order the work and the vendor text to understand the cause. The record does not mark the flaw as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.
The record lists Linux, macOS and Windows as platforms, which only reflects where Engine runs.
How to check if you're exposed
Find the version of each CrafterCMS installation, including authoring and delivery environments. The version is shown in the Studio user interface and in your deployment's release or container image tag. Any 4.0.x below 4.0.8 or 4.1.x below 4.1.6 is affected.
Then look at what your delivery tier serves. From a trusted machine, request a few folder paths on your public delivery site and check whether a listing of file names comes back. A page that lists files where you expect an error or a normal page is a sign that indexing is active. Do not probe systems you do not own.
Check logs for requests to directory paths on the delivery host that do not match your site structure, and note which sources made them.
If you run Crafter in containers or through an automated pipeline, check the image tag in each environment, since a fixed repository does not change running containers.
What to do now
- List every CrafterCMS installation and its version, including staging and disaster recovery copies.
- Upgrade 4.0.x installations to 4.0.8 or later, and 4.1.x installations to 4.1.6 or later, following CrafterCMS upgrade guidance.
- Redeploy delivery nodes and containers so the new version is what actually serves traffic.
- After upgrading, repeat the folder path check on a trusted machine to confirm listings are gone.
- Review what content and configuration sits in paths Engine can reach, and move anything private out of them.
- Read the advisory page directly to confirm the affected ranges before you close the ticket.
Why it matters
Directory indexing turns a web server into a file browser. Even when each file is harmless, a listing shows names, structure and versions, and it can reveal files nobody linked to. Private resources should not share a path with public ones, and the server should return an error rather than a list.
For a content platform, the delivery tier is the part facing the internet. A flaw there is reachable by anyone, so the practical exposure is larger than a medium vendor rating suggests.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which CrafterCMS versions are fixed?
4.0.8 in the 4.0 line and 4.1.6 in the 4.1 line, per the vendor advisory. Later releases include the fix too.
Why do the vendor and the CVSS score disagree?
The vendor labels the risk medium, while the CVSS base score is 9.1. Use the score to prioritise and the advisory text to understand the cause.
Sources
Last reviewed: 19 October 2026.
