CVE-2026-56258: Crawl4AI - Arbitrary File Write via output_path Symlink and TOCTOU
Crawl4AI before 0.8.8 contains an arbitrary file write vulnerability in the screenshot and PDF endpoints that allows unauthenticated attackers to write files outside the intended directory via symlink and time-of-check-time-of-use (TOCTOU) attacks on the outputpath parameter. Remote attackers can exploit insufficient path validation and symlink following to achieve arbitrary file write and potential code execution on systems where the runtime user has write access to executable or cron locations.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56258?
The severity of CVE-2026-56258 is rated as high with a CVSS score of 8.1.
How do I fix CVE-2026-56258?
To fix CVE-2026-56258, update Crawl4AI to version 0.8.8 or later.
What type of attacks can exploit CVE-2026-56258?
CVE-2026-56258 can be exploited through arbitrary file write attacks via symlink and TOCTOU techniques.
Who is affected by CVE-2026-56258?
Unauthenticated remote attackers can exploit CVE-2026-56258 to write files outside the intended directory.
What is the impact of CVE-2026-56258?
The impact of CVE-2026-56258 includes the potential for attackers to write files that may compromise system integrity and confidentiality.