CVE-2025-6384 is a Critical severity (CVSS 9.1) Groovy sandbox bypass in Crafter Studio, part of CrafterCMS 4.0.0 through 4.2.2. An authenticated developer can run operating system commands. The vendor advisory lists the affected range as 4.0 up to 4.3.0, so upgrade to 4.3.0 or later.
The weakness is CWE-913, improper control of dynamically managed code resources. The Gold page for the CVE is CVE-2025-6384 on Gold.
What's affected
- CrafterCMS, component Crafter Studio
- NVD description: 4.0.0 through 4.2.2
- CrafterCMS advisory CV-2025061901 (dated 19 June 2025): affected versions 4.0 up to but not including 4.3.0
- Fixed version: 4.3.0 is the first release outside the advisory's affected range. Confirm on the advisory page before you plan the upgrade.
The two sources agree on the range. The CVSS vector requires high privileges, which matches the description: the person must already be an authenticated developer in Studio. The advisory credits Matei Badanoiu for the report and rates the risk high.
How to check if you're exposed
Find your Studio version in the Studio UI under the about or system information area, or from your deployment records. For container based installs, read the image tag:
docker ps --format "table {{.Names}}\t{{.Image}}" | grep -i crafter
If the version is from 4.0 up to 4.2.2, you are in the affected range. Next, count who holds a developer role in Studio. The flaw needs that role, so the fewer people with it, the smaller your window until you upgrade.
What to do now
- Plan an upgrade of Crafter Studio to 4.3.0 or later, and read the release notes for migration steps first.
- Until then, review the list of Studio users with developer rights and remove any that are not needed.
- Make sure Studio is not reachable from the open internet, and require strong authentication and multi factor sign in where your setup allows it.
- Review recent changes to Groovy scripts and templates in your sites for entries nobody can explain.
- Treat the Studio host as sensitive. Run it with the least operating system rights and keep secrets out of its environment where possible.
- Use the free in-browser dependency scan on your own application dependencies, and the Gold directory to look up related records.
Try it yourself
Click through it at your own pace, or open it full screen.
Why it matters
Sandboxes for scripting languages are hard to get right. The idea is to let trusted editors write small scripts while blocking dangerous calls, and the risk is that a clever script finds a path the block list missed. The advisory describes this as a Groovy sandbox bypass leading to remote code execution for authenticated developers.
The privilege requirement lowers the score from the maximum, but it does not make the issue small. Developer accounts are shared, phished and left behind when people change teams, and Studio often sits close to publishing pipelines. CrafterCMS has had earlier advisories in the same class, for example CV-2022091301 and CV-2022091302 for the 3.1 line, so the pattern is worth watching in future releases. The record does not mark this CVE as known exploited.
Quick check
Do I need to be logged in to abuse this?
Yes. The description says authenticated developers, and the CVSS vector requires high privileges. That still covers any compromised or malicious developer account.
Which version fixes it?
The advisory lists 4.0 up to 4.3.0 as affected, so 4.3.0 or later is the target. Confirm on the advisory page.
Sources
Last reviewed: 18 October 2026.
