CVE-2026-56258

Katalog CVE

CVSS 8.1 · High EPSS 0,91%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada kidocode crawl4ai. Skor CVSS 3.1 8.1 (High) menurut vulncheck.com.

Deskripsi (NVD)

Crawl4AI before 0.8.8 contains an arbitrary file write vulnerability in the screenshot and PDF endpoints that allows unauthenticated attackers to write files outside the intended directory via symlink and time-of-check-time-of-use (TOCTOU) attacks on the output_path parameter. Remote attackers can exploit insufficient path validation and symlink following to achieve arbitrary file write and potential code execution on systems where the runtime user has write access to executable or cron locations.

Rincian

Terbit di NVD

23 Juni 2026

Terakhir diubah

25 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,91% peluang dieksploitasi; lebih tinggi dari 58,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/unclecode/crawl4ai/security/advisories/GHSA-7cx2-g3h9-382p advisory pihak ketiga
• https://www.vulncheck.com/advisories/crawl4ai-arbitrary-file-write-via-output-path-symlink-and-toctou advisory pihak ketiga