CVE-2026-56260: Crawl4AI - Arbitrary File Write via output_path Parameter
Crawl4AI before 0.8.7 contains an arbitrary file write vulnerability in the Docker API server's /screenshot and /pdf endpoints. The outputpath parameter accepts arbitrary filesystem paths without validation, allowing an attacker to supply absolute or path-traversal values to write to any location writable by the application's user, overwriting server files and causing denial of service.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56260?
CVE-2026-56260 has a severity rating of high with a score of 8.8.
How do I fix CVE-2026-56260?
To fix CVE-2026-56260, update to Crawl4AI version 0.8.7 or later where the vulnerability is addressed.
What does CVE-2026-56260 exploit?
CVE-2026-56260 exploits the arbitrary file write vulnerability in the Crawl4AI Docker API's /screenshot and /pdf endpoints.
What impact does CVE-2026-56260 have on my system?
CVE-2026-56260 allows an attacker to write files to arbitrary locations on the filesystem, which can lead to data compromise or system compromise.
What are the attack vectors for CVE-2026-56260?
The attack vectors for CVE-2026-56260 involve sending crafted requests to the affected API endpoints with malicious output_path parameters.