Crawl4AI CVE-2026-56258

Target must be a Crawl4AI Docker API server <= 0.8.7 exposing the POST /screenshot or POST /pdf endpoints with the default unauthenticated configuration (CRAWL4AI_API_TOKEN unset). The attacker must supply an output_path inside ALLOWED_OUTPUT_DIR where a symlink can be planted or a TOCTOU race won against validate_output_path; reaching code execution additionally requires that the container's runtime user have write permission to an executable or cron location (e.g., /etc/cron.d/, a binary on PATH), so hardened deployments running as an unprivileged user with a read-only root filesystem are limited to arbitrary writes within writable mounts rather than RCE. CVSS AC:H/AT:P reflects the symlink-staging and race-window requirements that limit reliability.

CVSS 4.0 of 9.2 (AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) reflects an unauthenticated network-reachable write with high attack complexity and a present attack requirement - the attacker must win a TOCTOU race or pre-position a symlink, which is non-trivial but feasible against a long-lived container. Exploitation impact is conditional: it only reaches code execution where the runtime user can write to executable or cron locations, so hardened containers (non-root, read-only rootfs) materially reduce real risk even before patching. No EPSS, KEV, or POC data was provided, so this should be treated as no public exploit identified at time of analysis despite the high CVSS; the unauthenticated-by-default posture and the fact that VulnCheck published an advisory raise priority for any internet-exposed Crawl4AI Docker deployment.

An attacker reachable to an unauthenticated Crawl4AI Docker server sends repeated POST /screenshot or POST /pdf requests with an output_path that points through a directory the attacker can race or pre-symlink, swapping in a symlink targeting /etc/cron.d/ or a binary the runtime user can overwrite. Winning the TOCTOU race between validate_output_path and the open() call writes attacker-controlled image/PDF bytes outside ALLOWED_OUTPUT_DIR; on hosts where the container runs as a user with write access to executable or cron paths, this yields code execution at the next scheduler tick. No public POC has been identified at time of analysis.