EUVD-2026-43227
GHSA-r9hw-78q5-478g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Crawl4AI Docker server
-
DeliverySend crafted /screenshot or /pdf request
-
ExploitSet output_path to traversal or absolute path
-
ExecutionServer writes file outside output directory
-
PersistOverwrite critical server file
-
ImpactDenial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a reachable Crawl4AI Docker API server (versions before 0.8.7) with the /screenshot or /pdf endpoints accessible, and per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction against a default, unauthenticated deployment. The concrete prerequisite is that the attacker can submit the output_path parameter to those endpoints, and that the destination path is writable by the application's OS user - so exploitation is limited to files within that user's write permissions. Limiting factors: the library used without the Docker API server is not exposed, and deployments that enable the server's optional API token or restrict network access remove the unauthenticated remote path. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H) and score of 8.8 describe a network-reachable, low-complexity attack needing no privileges or user interaction, with high integrity and availability impact but no confidentiality loss - consistent with a write/overwrite-only primitive rather than data theft. No EPSS score, KEV entry, or POC was provided, so real-world exploitation pressure is currently unquantified; the honest read is 'high theoretical severity, unproven exploitation.' The most important caveat is exposure: the vulnerable surface is the Docker API server, which is only at risk when actually deployed and network-reachable, and the PR:N rating assumes the deployment does not enforce the optional API token - if token auth is enabled, effective privilege requirements rise. Treat this as a genuine priority for anyone running the Crawl4AI Docker server unauthenticated on a reachable network, and lower priority for library-only or firewalled internal use. |
| Exploit ScenarioDerived | An attacker who can reach an exposed Crawl4AI Docker server sends a crafted POST to /screenshot or /pdf with output_path set to a traversal or absolute path such as '../../app/server_config' or a path over a critical application file. The server renders the artifact and writes it to the attacker-chosen location, overwriting the target file and rendering the service inoperable (denial of service). No exploit code has been published, but the request is trivial to construct given the documented parameter behavior. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 12, 2026
Arbitrary file write in Crawl4AI's Docker API server (versions before 0.8.7) lets remote unauthenticated attackers overwrite any file writable by the service account by abusing the unvalidated output_path parameter on the /screenshot and /pdf endpoints. Reported by VulnCheck and disclosed in GitHub advisory GHSA-365w-hqf6-vxfg, the flaw enables path traversal or absolute-path writes that corrupt server files and cause denial of service. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-privileges attack surface makes it a straightforward target once a Crawl4AI Docker server is exposed.
RemediationAI
Vendor-released patch: upgrade Crawl4AI to 0.8.7 or later, which adds validation of the output_path parameter; this is the primary and recommended fix per advisory GHSA-365w-hqf6-vxfg (https://github.com/unclecode/crawl4ai/security/advisories/GHSA-365w-hqf6-vxfg). If immediate upgrade is not possible, do not expose the Docker API server to untrusted networks - bind it to localhost or place it behind a reverse proxy and enable the server's API token authentication to remove the unauthenticated path, accepting that legitimate remote clients must then present credentials. As additional compensating controls, run the container as a low-privilege, non-root user with a read-only root filesystem and only the intended screenshot/PDF output directory mounted writable, which contains the blast radius of any write to that directory (trade-off: you must ensure the output directory is correctly provisioned or rendering will fail). Avoid granting the service write access to configuration, code, or system paths.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Crawl4AI is a widely used open-source, LLM-oriented web crawling and scraping framework that ships an optional FastAPI-based Docker API server for remote crawling jobs. The /screenshot and /pdf endpoints let callers render a page and persist the artifact to a location given by the output_path request parameter. Because that parameter is passed to filesystem write operations without canonicalization or allowlist validation, it is a textbook CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal) issue: supplying '../' sequences or an absolute path (e.g. /app/config, /etc/... if writable) redirects the write outside the intended output directory. The single CPE cpe:2.3:a:crawl4ai:crawl4ai:*:*:*:*:*:*:*:* confirms the affected component is the crawl4ai application itself across all versions prior to the fixed 0.8.7.
Know when Crawl4ai gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Remote, low-complexity, unauthenticated write to the default Docker server (AV:N/AC:L/PR:N); write-only primitive gives I:H and A:H via file overwrite/DoS, with no confidentiality impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Crawl4AI before 0.8.7 contains an arbitrary file write vulnerability in the Docker API server's /screenshot and /pdf endpoints. The output_path parameter accepts arbitrary filesystem paths without validation, allowing an attacker to supply absolute or path-traversal values to write to any location writable by the application's user, overwriting server files and causing denial of service.
Executive ViewAI
Crawl4AI Docker API server versions before 0.8.7 allow unauthenticated remote attackers to write arbitrary files, risking data corruption and service disruption across organizations deploying this component. While no public exploit identified at time of analysis, the network-reachable attack surface and absence of an available patch make this vulnerability an immediate operational risk requiring urgent containment. Unpatched instances exposed to untrusted networks face compromise risk from attackers seeking to corrupt files or degrade service availability.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to Crawl4AI API via firewall/VPN, allowing only trusted internal clients; (2) Run Crawl4AI service with dedicated non-root account and restrict file-system write permissions to necessary directories only; (3) Enable auditd or equivalent file-integrity monitoring on application and data directories; (4) Disable /screenshot and /pdf endpoints if not operationally required; (5) Maintain continuous monitoring of GHSA-365w-hqf6-vxfg for patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Remote code execution in Crawl4AI Docker API before 0.8.0 via hooks parameter. The /crawl endpoint accepts Python code i
Authentication bypass in Crawl4AI Docker API server (versions prior to 0.8.7) allows remote unauthenticated attackers to
Arbitrary local file disclosure in Crawl4AI's Docker API (versions before 0.8.0) lets unauthenticated remote attackers r
Remote code execution in Crawl4AI's Docker API server (versions prior to 0.9.0) lets unauthenticated attackers run arbit
Arbitrary file write in Crawl4AI (the open-source LLM-friendly web crawler by unclecode) before version 0.9.0 lets a mal
Arbitrary file write in Crawl4AI Docker API server before 0.8.8 lets unauthenticated remote attackers escape the ALLOWED
Arbitrary JavaScript execution in Crawl4AI's Docker API server (versions before 0.8.7) lets remote attackers submit code
Server-side request forgery in Crawl4AI's Docker API server (versions before 0.8.7) allows remote unauthenticated attack
Server-side request forgery in Crawl4AI (unclecode) versions 0.7.0 through 0.9.3 lets unauthenticated, remote API client
Server-side request forgery in Crawl4AI before 0.8.7 allows unauthenticated remote attackers to coerce the server into f
Crawl4AI <=0.4.247 is vulnerable to SSRF in /crawl4ai/async_dispatcher.py. Rated critical severity (CVSS 9.1), this vuln
Credential exfiltration in Crawl4AI's Docker API server (all versions before 0.8.8) lets remote unauthenticated attacker
Exploit-DB