CVE-2026-56260 – Arbitrary File Write Leading to DoS and Potential RCE – Crawl4AI before 0.8.7

Summary

CVE-2026-56260 is a high-severity path traversal vulnerability (CWE-22) in Crawl4AI’s Docker API server, affecting all versions before 0.8.7. The output_path parameter accepted by the /screenshot and /pdf endpoints performs no filesystem path validation, allowing an unauthenticated remote attacker to write files to any location accessible by the application’s user. The vulnerability carries a CVSS 3.1 score of 9.1 (Critical) and can result in denial of service through overwriting of critical server files, with the potential to escalate to remote code execution depending on the runtime user’s permissions.

Technical details

• Root cause: The output_path parameter in the Docker API server’s /screenshot and /pdf endpoints accepts absolute paths and path-traversal sequences (e.g., ../) without any validation or restriction, enabling writes outside any intended output directory.
• Trigger conditions: A crafted HTTP request to either the /screenshot or /pdf endpoint with a malicious output_path value is sufficient to exploit the vulnerability. No authentication, prior access, or user interaction is required.
• Attack vector: Network-accessible. The Crawl4AI Docker API server listens on port 11235 by default and, in versions prior to 0.8.7, requires no API token by default, making the endpoints fully unauthenticated.
• Impact: Arbitrary file write to any path writable by the application process. Direct consequences include denial of service through overwriting of critical server or configuration files. Where the runtime user holds broader write permissions, attackers can overwrite cron jobs, SSH authorized keys, startup scripts, or application code to achieve remote code execution.

Affected software

• Crawl4AI (PyPI: crawl4ai) — all versions before 0.8.7

Severity

CVSS v3.1 base score: 9.1 (Critical)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Mitigation and recommended actions

• Immediate: Upgrade Crawl4AI to version 0.8.7 or later, which introduces path validation that restricts output writes to a designated directory.
• If immediate patching is not feasible: restrict network-level access to the Docker API server (port 11235) to trusted IP ranges only, and set the CRAWL4AI_API_TOKEN environment variable to enforce token-based authentication on all endpoints.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

References

• CVE-2026-56260 at NIST
• GitHub Security Advisory GHSA-365w-hqf6-vxfg