Which versions of Crawl4AI are affected by CVE-2026-56260?

Crawl4AI Docker API server versions before 0.8.7 allow unauthenticated remote attackers to write arbitrary files, risking data corruption and service disruption across organizations deploying this…. A patch is available.

How to fix or mitigate CVE-2026-56260?

Within 24 hours: Inventory all Crawl4AI deployments and identify versions below 0.8.7; restrict network access to the Docker API and /screenshot and /pdf endpoints using firewall rules. Within 7 days: Implement dedicated service account with minimal file-write permissions; enable file integrity monitoring on application directories; log all API requests to these endpoints. Within 30 days: Monitor Crawl4AI GitHub advisory GHSA-365w-hqf6-vxfg and vendor announcements for patch release; establish upgrade testing procedures; evaluate alternative web-scraping tools if patch timeline remains undefined beyond 60 days.

Crawl4AI CVE-2026-56260

Q: What is the CVSS score of CVE-2026-56260?

CVE-2026-56260 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-43227 HIGH

Path Traversal (CWE-22)

2026-07-12 VulnCheck

GHSA-r9hw-78q5-478g

Denial Of Service Docker Path Traversal Crawl4ai

8.8

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Remote, low-complexity, unauthenticated write to the default Docker server (AV:N/AC:L/PR:N); write-only primitive gives I:H and A:H via file overwrite/DoS, with no confidentiality impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 12, 2026 - 13:01 EUVD

Analysis Generated

Jul 12, 2026 - 12:37 vuln.today

CVE Published

Jul 12, 2026 - 12:06 cve.org

HIGH 8.8

DescriptionCVE.org

Crawl4AI before 0.8.7 contains an arbitrary file write vulnerability in the Docker API server's /screenshot and /pdf endpoints. The output_path parameter accepts arbitrary filesystem paths without validation, allowing an attacker to supply absolute or path-traversal values to write to any location writable by the application's user, overwriting server files and causing denial of service.

AnalysisAI

Arbitrary file write in Crawl4AI's Docker API server (versions before 0.8.7) lets remote unauthenticated attackers overwrite any file writable by the service account by abusing the unvalidated output_path parameter on the /screenshot and /pdf endpoints. Reported by VulnCheck and disclosed in GitHub advisory GHSA-365w-hqf6-vxfg, the flaw enables path traversal or absolute-path writes that corrupt server files and cause denial of service. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-privileges attack surface makes it a straightforward target once a Crawl4AI Docker server is exposed.

Technical ContextAI

Crawl4AI is a widely used open-source, LLM-oriented web crawling and scraping framework that ships an optional FastAPI-based Docker API server for remote crawling jobs. The /screenshot and /pdf endpoints let callers render a page and persist the artifact to a location given by the output_path request parameter. Because that parameter is passed to filesystem write operations without canonicalization or allowlist validation, it is a textbook CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal) issue: supplying '../' sequences or an absolute path (e.g. /app/config, /etc/... if writable) redirects the write outside the intended output directory. The single CPE cpe:2.3:a:crawl4ai:crawl4ai:*:*:*:*:*:*:*:* confirms the affected component is the crawl4ai application itself across all versions prior to the fixed 0.8.7.

RemediationAI

Vendor-released patch: upgrade Crawl4AI to 0.8.7 or later, which adds validation of the output_path parameter; this is the primary and recommended fix per advisory GHSA-365w-hqf6-vxfg (https://github.com/unclecode/crawl4ai/security/advisories/GHSA-365w-hqf6-vxfg). If immediate upgrade is not possible, do not expose the Docker API server to untrusted networks - bind it to localhost or place it behind a reverse proxy and enable the server's API token authentication to remove the unauthenticated path, accepting that legitimate remote clients must then present credentials. As additional compensating controls, run the container as a low-privilege, non-root user with a read-only root filesystem and only the intended screenshot/PDF output directory mounted writable, which contains the blast radius of any write to that directory (trade-off: you must ensure the output directory is correctly provisioned or rendering will fail). Avoid granting the service write access to configuration, code, or system paths.