CVE-2026-82286: gpt-crawler Arbitrary File Write via outputFileName Parameter
gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthenticated attackers to write arbitrary files to any filesystem path. Attackers can supply absolute paths or parent-directory segments to overwrite existing files with content sourced from attacker-controlled URLs.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Any deployment of gpt-crawler through 1.5.1 that exposes the POST /crawl endpoint to untrusted network clients is exposed, because exploitation does not require authentication.
What does an attacker need to exploit it?
An attacker only needs network access to POST /crawl. They can provide an outputFileName containing an absolute path or parent-directory segments and cause content fetched from an attacker-controlled URL to be written to that path.
Can existing files be affected?
Yes. The issue allows attackers to overwrite existing files at filesystem paths accessible to the gpt-crawler process.