PT-2026-4851 · Pypi · Crawl4Ai

Publicado

2026-01-16

·

Atualizado

2026-01-16

CVSS v4.0

9.2

Crítica

VetorAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
A local file inclusion vulnerability exists in the Crawl4AI Docker API. The /execute js, /screenshot, /pdf, and /html endpoints accept file:// URLs, allowing attackers to read arbitrary files from the server filesystem.
Attack Vector:
json
POST /execute js
{
  "url": "file:///etc/passwd",
  "scripts": ["document.body.innerText"]
}
Impact
An unauthenticated attacker can:
  • Read sensitive files (/etc/passwd, /etc/shadow, application configs)
  • Access environment variables via /proc/self/environ
  • Discover internal application structure
  • Potentially read credentials and API keys
Workarounds
  1. Disable the Docker API
  2. Add authentication to the API
  3. Use network-level filtering

Correção

Path traversal

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

GHSA-VX9W-5CX4-9796

Produtos afetados

Crawl4Ai