Loading vulnerability…
Arbitrary File Write in Crawl4AI Docker API Server
CVE-2026-56260 is an arbitrary file write vulnerability in Crawl4AI before version 0.8.7. The flaw affects the Docker API server’s /screenshot and /pdf endpoints, where the output_path parameter is not properly validated before being used as the destination for generated screenshot or PDF output. Because the application accepts absolute paths and directory traversal sequences, a remote attacker can cause the server to write attacker-controlled output to arbitrary filesystem locations writable by the application user. The vulnerable behavior is described in the FastAPI processing logic for screenshot and PDF generation, where the supplied path is resolved and then opened for binary write without confinement to an intended output directory. This enables overwriting existing files and modifying application or system state within the permissions of the Crawl4AI process.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a remote attacker to write files to arbitrary locations writable by the Crawl4AI service account. This can be used to overwrite application files, configuration, scheduled task definitions, or other critical server-side resources, resulting in integrity compromise and denial of service. In environments where writable locations influence authentication or execution flow, the vulnerability may also enable persistence, such as by planting authorized keys or modifying scheduled execution artifacts. The documented scoring indicates high integrity and availability impact, with no confirmed confidentiality impact in the available information.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict network access to the Docker API server and specifically to the /screenshot and /pdf endpoints so that untrusted users cannot reach them. Run the application with the minimum filesystem privileges necessary, limiting writable directories and avoiding execution under accounts that can modify sensitive application, system, or persistence-related files. Additional compensating controls include isolating the service in a constrained container or sandbox and monitoring for unexpected file modifications caused by endpoint abuse.
Patch, then assume compromise.
Upgrade Crawl4AI to version 0.8.7 or later. The fixed release restricts writes to a predefined output directory, rejects traversal patterns such as ../, and applies validation logic to prevent arbitrary filesystem destinations from being accepted by the affected endpoints. Any deployment running version 0.8.6 or earlier should be updated immediately.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.