CVE-2026-56260

Katalog CVE

CVSS 9.1 · Critical EPSS 0,65%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada kidocode crawl4ai. Skor CVSS 3.1 9.1 (Critical) menurut vulncheck.com.

Deskripsi (NVD)

Crawl4AI before 0.8.7 contains an arbitrary file write vulnerability in the Docker API server's /screenshot and /pdf endpoints. The output_path parameter accepts arbitrary filesystem paths without validation, allowing an attacker to supply absolute or path-traversal values to write to any location writable by the application's user, overwriting server files and causing denial of service.

Rincian

Terbit di NVD

12 Juli 2026

Terakhir diubah

14 Juli 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,65% peluang dieksploitasi; lebih tinggi dari 49,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/unclecode/crawl4ai/security/advisories/GHSA-365w-hqf6-vxfg advisory vendor
• https://www.vulncheck.com/advisories/crawl4ai-arbitrary-file-write-via-output-path-parameter advisory pihak ketiga
• https://github.com/unclecode/crawl4ai product