Which versions of Crawl4AI are affected by CVE-2026-56258?

Crawl4AI Docker API server (versions before 0.8.8) contains a critical arbitrary file write vulnerability enabling unauthenticated remote attackers to bypass directory restrictions and potentially…. A patch is available.

How to fix or mitigate CVE-2026-56258?

Within 24 hours: Audit all deployments of Crawl4AI versions prior to 0.8.8 to identify instances exposed on untrusted networks; determine if the /screenshot and /pdf endpoints can be safely disabled. Within 7 days: Implement network segmentation and firewall rules to restrict API access to trusted internal networks only; deploy an authenticating reverse proxy or require VPN access until a patch is released. Within 30 days: Subscribe to vendor security advisories; obtain and validate version 0.8.8 or later in a staging environment; deploy the patched version across production infrastructure.

Crawl4AI CVE-2026-56258

Q: What is the CVSS score of CVE-2026-56258?

CVE-2026-56258 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2026-38432 CRITICAL

Path Traversal (CWE-22)

2026-06-23 VulnCheck

GHSA-wx2c-3cp2-f6qw

RCE Path Traversal Crawl4ai

9.2

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Unauthenticated network endpoint (AV:N/PR:N), but exploitation requires winning a TOCTOU race and symlink staging (AC:H); arbitrary write enables full host compromise when runtime user can write executables.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 23, 2026 - 14:17 EUVD

Source Code Evidence Fetched

Jun 23, 2026 - 13:05 vuln.today

Analysis Generated

Jun 23, 2026 - 13:05 vuln.today

DescriptionCVE.org

Crawl4AI before 0.8.8 contains an arbitrary file write vulnerability in the screenshot and PDF endpoints that allows unauthenticated attackers to write files outside the intended directory via symlink and time-of-check-time-of-use (TOCTOU) attacks on the output_path parameter. Remote attackers can exploit insufficient path validation and symlink following to achieve arbitrary file write and potential code execution on systems where the runtime user has write access to executable or cron locations.

AnalysisAI

Arbitrary file write in Crawl4AI Docker API server before 0.8.8 lets unauthenticated remote attackers escape the ALLOWED_OUTPUT_DIR via symlinks and a TOCTOU race on the output_path parameter of the /screenshot and /pdf endpoints, potentially escalating to code execution where the runtime user can write to executable or cron paths. No public exploit identified at time of analysis, but the API is unauthenticated by default and the GHSA confirms the issue was found in an internal security audit.

Technical ContextAI

Crawl4AI is a Python web-crawling/scraping framework (pip package crawl4ai) commonly run via its Docker API server. The vulnerable validate_output_path function in 0.8.7 performed string-only containment checks against ALLOWED_OUTPUT_DIR without resolving symlinks, and the subsequent open() call followed symlinks, producing the classic CWE-22 path traversal pattern combined with a CWE-367 TOCTOU race between validation and write. The 0.8.8 fix resolves the parent's real path, re-checks containment, and writes with O_NOFOLLOW via a new write_output_file helper. The CPE cpe:2.3:a:crawl4ai:crawl4ai:*:*:* covers all versions up to and including 0.8.7.

RemediationAI

Vendor-released patch: upgrade pip package crawl4ai to 0.8.8 or later, which resolves the real path of the output_path parent, re-checks containment after symlink resolution, and writes with O_NOFOLLOW (see PR https://github.com/unclecode/crawl4ai/pull/3 and advisory https://github.com/unclecode/crawl4ai/security/advisories/GHSA-7cx2-g3h9-382p). If immediate upgrade is not possible, enable authentication by setting CRAWL4AI_API_TOKEN - this closes unauthenticated access but will break any existing clients that do not send the token - and run the container with a read-only root filesystem to neutralize the write-to-execute primitive, which may break other features that expect writable paths outside ALLOWED_OUTPUT_DIR. As a network-level control, restrict ingress to /screenshot and /pdf endpoints to trusted internal callers only until the upgrade is applied.