CVE-2026-56258
High
Description
Crawl4AI before 0.8.8 contains an arbitrary file write vulnerability in the screenshot and PDF endpoints that allows unauthenticated attackers to write files outside the intended directory via symlink and time-of-check-time-of-use (TOCTOU) attacks on the output_path parameter. Remote attackers can exploit insufficient path validation and symlink following to achieve arbitrary file write and potential code execution on systems where the runtime user has write access to executable or cron locations.
SeverityHigh
CVSS8.1
Exploit probability—
ProductKidocode Crawl4ai
PublishedJun 23, 2026
First seenJun 23, 2026
Weakness typeCWE-22Path traversal
How to fix
Update
- kidocode crawl4ai0.8.8 or later
- crawl4ai0.8.8 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kidocode crawl4ai | v < 0.8.8 | 0.8.8 |
| crawl4aiPyPI | v < 0.8.8 | 0.8.8 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.