CVE-2026-26217
High
Description
Crawl4AI versions prior to 0.8.0 contain a local file inclusion vulnerability in the Docker API deployment. The /execute_js, /screenshot, /pdf, and /html endpoints accept file:// URLs, allowing unauthenticated remote attackers to read arbitrary files from the server filesystem. An attacker can access sensitive files such as /etc/passwd, /etc/shadow, application configuration files, and environment variables via /proc/self/environ, potentially exposing credentials, API keys, and internal application structure.
SeverityHigh
CVSS8.6
Exploit probability—
ProductKidocode Crawl4ai
PublishedFeb 12, 2026
First seenFeb 12, 2026
Weakness typeCWE-22Path traversal
How to fix
Update
- kidocode crawl4ai0.8.0 or later
- crawl4ai0.8.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kidocode crawl4ai | v < 0.8.0 | 0.8.0 |
| crawl4aiPyPI | v < 0.8.0 | 0.8.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.