CVE-2026-26217: Crawl4AI < 0.8.0 Docker API Local File Inclusion via file URL Handling
Crawl4AI versions prior to 0.8.0 contain a local file inclusion vulnerability in the Docker API deployment. The /executejs, /screenshot, /pdf, and /html endpoints accept file:// URLs, allowing unauthenticated remote attackers to read arbitrary files from the server filesystem. An attacker can access sensitive files such as /etc/passwd, /etc/shadow, application configuration files, and environment variables via /proc/self/environ, potentially exposing credentials, API keys, and internal application structure.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Crawl4AIto a version that resolves this vulnerability.Fixed in 0.8.0 - Compensating control
Block unauthenticated external access to the Docker API deployment endpoints that are affected by the file:// URL handling vulnerability, including /execute_js, /screenshot, /pdf, and /html, until Crawl4AI is upgraded to 0.8.0.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-26217?
CVE-2026-26217 is classified as a high severity local file inclusion vulnerability.
How do I fix CVE-2026-26217?
To fix CVE-2026-26217, upgrade Crawl4AI to version 0.8.0 or higher.
What are the affected endpoints for CVE-2026-26217?
The affected endpoints for CVE-2026-26217 include /execute_js, /screenshot, /pdf, and /html.
Who can exploit CVE-2026-26217?
CVE-2026-26217 can be exploited by unauthenticated remote attackers.
Which versions of Crawl4AI are vulnerable to CVE-2026-26217?
All versions of Crawl4AI prior to 0.8.0 are vulnerable to CVE-2026-26217.