Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.6
CVE-2026-57571: Crawl4AI: Uncontrolled File Writes from Malicious Input
CVE-2026-57571
Summary
The Crawl4AI web crawler and scraper saves downloaded files using user-controlled names, potentially allowing attackers to write files anywhere on the system. This could lead to remote code execution if an attacker can manipulate the file contents. To fix this issue, update to version 0.9.0 or later.
Original title
Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, when the crawler saves a downloaded file, the destination filename was taken from attacker-influenced input and join...
Original description
Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, when the crawler saves a downloaded file, the destination filename was taken from attacker-influenced input and joined to the downloads directory with no confinement. A filename containing an absolute path or traversal escaped the downloads directory, giving an arbitrary file write with attacker-controlled contents; the HTTP crawler path uses the response Content-Disposition filename and the browser crawler path uses the download's suggested filename. Because the written bytes are attacker-controlled, this can escalate to remote code execution. This issue is fixed in version 0.9.0.
nvd CVSS3.1
9.6
Vulnerability type
CWE-22
Path Traversal
CWE-59
Link Following
Published: 6 Jul 2026 · Updated: 23 Jul 2026 · First seen: 6 Jul 2026