by Kastro
Paper/Archive/CVE-2026-56260

CVE-2026-56260

Crawl4AI Crawl4AI — Crawl4AI - Arbitrary File Write via output_path Parameter

EPSS 0.6%CVSS 9.1
critical.is priorityof 100
38
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 51.1.511 × 2010.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Crawl4AI before 0.8.7 contains an arbitrary file write vulnerability in the Docker API server's /screenshot and /pdf endpoints. The output_path parameter accepts arbitrary filesystem paths without validation, allowing an attacker to supply absolute or path-traversal values to write to any location writable by the application's user, overwriting server files and causing denial of service.

Affected

ProductAffectedFixed inSource
Crawl4AI< 0.8.70.8.7CNA

Scores by source

VulnCheck (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
VulnCheck (CNA)8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

advisorygithub.com/unclecode/crawl4ai/security/advisories/GHSA-365w-hqf6-vxfgrefgithub.com/unclecode/crawl4aiwriteupvulncheck.com/advisories/crawl4ai-arbitrary-file-write-via-output-path-parameter