PT-2026-7856 · Crawl4Ai · Crawl4Ai

Neo · Published 2026-01-16 · Updated 2026-02-20 · CVE-2026-26217

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Crawl4AI versions prior to 0.8.0

Description Crawl4AI is affected by a local file inclusion issue in its Docker API deployment. The /execute js, /screenshot, /pdf, and /html API endpoints accept file:// URLs, which allows unauthenticated remote attackers to read arbitrary files from the server filesystem. An attacker can access sensitive files such as /etc/passwd, /etc/shadow, application configuration files, and environment variables via /proc/self/environ, potentially exposing credentials, API keys, and internal application structure. An example attack vector involves sending a POST request to the /execute js endpoint with a url parameter set to file:///etc/passwd and a scripts parameter.

Recommendations Versions prior to 0.8.0: Disable the Docker API. Versions prior to 0.8.0: Add authentication to the API. Versions prior to 0.8.0: Use network-level filtering.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-26217

GHSA-VX9W-5CX4-9796

PYSEC-2026-34

Affected Products

Crawl4Ai

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2026-26217 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-34 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vx9w-5cx4-9796 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-26217 · Vendor Advisory
• https://github.com/unclecode/crawl4ai/blob/main/docs/blog/release-v0.8.0.md · Note
• https://github.com/unclecode/crawl4ai/security/advisories/GHSA-vx9w-5cx4-9796 · Patch, Vendor Advisory
• https://github.com/unclecode/crawl4ai/blob/release/v0.8.0/docs/blog/release-v0.8.0.md · Note
• https://github.com/unclecode/crawl4ai · Note
• https://github.com/unclecode/crawl4ai/blob/release/v0.8.0/docs/migration/v0.8.0-upgrade-guide.md · Note
• https://vulncheck.com/advisories/crawl4ai-docker-api-local-file-inclusion-via-file-url-handling · Note
• https://twitter.com/TheHackerWire/status/2021981909442818307 · Twitter Post
• https://twitter.com/offseq/status/2021977653167747407 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2021992467734655317 · Twitter Post
• https://t.me/cveNotify/152607 · Telegram Post
• https://t.me/CVEtracker/44542 · Telegram Post