CVE-2026-56260 Details
Description
Crawl4AI before 0.8.7 contains an arbitrary file write vulnerability in the Docker API server's /screenshot and /pdf endpoints. The output_path parameter accepts arbitrary filesystem paths without validation, allowing an attacker to supply absolute or path-traversal values to write to any location writable by the application's user, overwriting server files and causing denial of service.
An arbitrary file write vulnerability has been identified in Crawl4AI versions prior to 0.8.7. This issue resides within the Docker API server, specifically in the /screenshot and /pdf endpoints. The vulnerability arises because the output_path parameter allows users to input arbitrary filesystem paths without any validation. As a result, an attacker could exploit this by providing absolute paths or using path traversal techniques to write to any location that the application's user can access. This could lead to overwriting server files, causing a denial-of-service condition.
Users are advised to upgrade to Crawl4AI version 0.8.7 or later, where this vulnerability has been patched. For those using versions prior to 0.8.7, it is recommended to set the CRAWL4AI_API_TOKEN environment variable to enable authentication and restrict network access to the Docker API.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| kidocode crawl4ai | < 0.8.7 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | Initial Analysis | [email protected] |
| Jul 13, 2026 | CVE Modified | CISA-ADP |
| Jul 12, 2026 | New CVE Received | [email protected] |