Crawl4AI CVE-2026-57571

Exploitation requires that a Crawl4AI instance prior to 0.9.0 downloads and saves a file originating from attacker-controlled content - specifically the HTTP crawler path is triggered when the malicious server sets a crafted Content-Disposition filename (absolute path or ../ traversal), and the browser crawler path is triggered when a download's suggested filename is crafted; file-download handling must be exercised by the crawl. The primary limiting factor is user/pipeline interaction (CVSS UI:R): the victim must actually crawl the attacker-influenced URL or resource, so it is not autonomously exploitable against a passive host. No authentication is required against the victim (PR:N/unauthenticated on the crawler side), and no non-default feature toggle beyond normal download-saving behavior is needed; realistic impact depends on the privileges and filesystem confinement of the account running the crawler.

Signals are broadly consistent toward high priority but with one important caveat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6) reflects a remote, low-complexity, unauthenticated (PR:N) attack with scope change and full CIA impact via RCE - however the UI:R flag is the key limiter: exploitation is not fully autonomous, it requires the victim to crawl attacker-controlled content, so this is not a wormable server-side bug but a client/pipeline-side one triggered by processing malicious input. No EPSS score was provided and no SSVC decision data was supplied, so automatability cannot be quantified from the input; the vulnerability is not in CISA KEV and no POC is referenced, so there is no evidence of active or public exploitation yet. Net: a genuinely critical, easy-to-trigger flaw for anyone crawling untrusted URLs, but the real-world risk hinges on whether the deployment points Crawl4AI at attacker-controllable sites (which is precisely its intended use), making this a real priority for crawling/RAG operators rather than a hypothetical high-CVSS item.

An attacker stands up (or compromises) a website that a target's Crawl4AI-based pipeline will crawl, and serves a file whose Content-Disposition header (HTTP path) or browser-suggested download name (browser path) contains a traversal/absolute path such as ../../../../home/app/.bashrc or a path into a Python site-packages module, with malicious contents. When the crawler downloads and saves the file, the bytes are written outside the downloads directory to an execution-relevant location, and code runs the next time that file is loaded or the process/user starts a shell. No public POC is referenced, but the low attack complexity makes exploitation straightforward once a victim crawls the malicious URL.