Loading story…
A critical path traversal flaw tracked as CVE-2026-56260 allows unauthenticated remote attackers to write arbitrary files on servers running vulnerable versions of Crawl4AI. The issue affects the Docker API server’s /screenshot and /pdf endpoints, where the output_path parameter accepts absolute paths and directory traversal sequences without proper validation. The vulnerability impacts versions up to and including 0.8.6 and was fixed in 0.8.7.
By overwriting files writable by the application user, attackers could cause denial of service and compromise system integrity, including planting SSH authorized keys or injecting cron jobs for persistence. The flaw is classified as CWE-22 and carries a CVSS 9.1 rating with network-based, unauthenticated exploitation potential. Reports said no public proof-of-concept or confirmed active exploitation had emerged at publication time, and advised organizations to upgrade immediately or restrict access to the exposed endpoints as a compensating control.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Version 0.8.7 was identified as unaffected and described as the fix for CVE-2026-56260. The patch restricts writes to a predefined output directory and rejects traversal sequences such as ../.
A new CVE, CVE-2026-56260, was recorded for an arbitrary file write vulnerability in Crawl4AI affecting the Docker API server's /screenshot and /pdf endpoints via the output_path parameter. The issue affects versions up to 0.8.6 and can let unauthenticated remote attackers overwrite writable files on the server.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Crawl4AI disclosed critical vulnerabilities in its Docker API server affecting versions `0.8.6` and earlier, including an AST sandbox escape in the computed fields feature that allowed **unauthenticated remote code execution** through the `/crawl` endpoint. The flaw let attackers abuse Python generator and frame attributes such as `gi_frame`, `f_back`, and `f_builtins` to reach `__import__` and run arbitrary OS commands inside the container. Additional reported weaknesses in the network-exposed API included unsafe code execution controls, server-side request forgery, missing authentication protections, hardcoded credentials, and improper path sanitization affecting endpoints including `/screenshot`, `/pdf`, `/crawl`, and `/execute_js`. The project patched the issues in version `0.8.7` by removing `eval()` from the computed-field execution path, replacing the prior underscore-based attribute blocklist with a stricter allowlist, tightening `_safe_eval_config`, and removing dangerous built-ins from the hook manager. The update also added path validation to stop traversal-style file writes and introduced adversarial security tests covering the reported exploit chains. Maintainers advised users to upgrade immediately, enable JWT authentication with `CRAWL4AI_API_TOKEN`, configure secrets securely, restrict network exposure of the Docker API, and disable JavaScript execution where it is not required.
Jun 29, 2026
Multiple newly disclosed vulnerabilities exposed **arbitrary file write** paths through symlink handling and path validation failures in developer and server-side software. In **Crawl4AI** before `0.8.8`, `CVE-2026-56258` affects screenshot and PDF endpoints by combining weak `output_path` validation, symlink following, and a **TOCTOU** race, allowing unauthenticated remote attackers to write files outside the intended directory and potentially reach code execution. In **Cursor Desktop** before `3.0`, `CVE-2026-50549` lets a malicious agent escape the workspace sandbox by forcing path canonicalization to fail and then abusing an in-workspace symlink to write arbitrary files under the user’s privileges, including paths that could enable later unsandboxed execution. A related pattern also appeared in archive extraction and privileged upload handling. The **extract-zip** package is affected by `CVE-2026-56876`, which fails to validate symlink targets inside ZIP archives, enabling path traversal outside the extraction directory and possible arbitrary file read or write when processing untrusted archives. Separately, **pwnlift** disclosed `CVE-2026-56815` in a privileged upload handler that could be abused for arbitrary file write **as root** through direct symlink following and a TOCTOU race; an initial fix was bypassable before a follow-up patch was merged, while one downstream deployment mitigated exposure by removing the privileged `sudo` entry. Together, the disclosures highlight recurring risk from incomplete path canonicalization, unsafe symlink handling, and containment checks in file-write workflows.
Jul 2, 2026
Two high-severity vulnerabilities were disclosed affecting exposed application and device management surfaces, including a flaw that can give attackers **root access** and another that enables **arbitrary file write** through path traversal. **CVE-2026-3587** describes an unauthenticated remote attack path in a hidden CLI function that lets an attacker escape a restricted prompt and gain root access to the underlying Linux operating system, potentially leading to full device compromise. The issue was mapped to `CWE-912` and assigned a `CVSS v3.1` score vector of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`, with CERT VDE publishing advisory `VDE-2026-020`. A separate vulnerability, **CVE-2026-5027**, affects Langflow's `POST /api/v2/files` endpoint, where improper sanitization of the multipart `filename` parameter allows path traversal using `../` sequences. An authenticated attacker can exploit the bug to write files to arbitrary filesystem locations, creating a route to compromise confidentiality, integrity, and availability. The flaw was classified as `CWE-22`, carries the `CVSS v3.1` vector `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, and is referenced in Tenable advisory `TRA-2026-26`.
Jun 29, 2026