CVE-2026-56258

Name of the Vulnerable Software and Affected Versions Crawl4AI versions prior to 0.8.8

Description An arbitrary file write issue exists in the screenshot and PDF endpoints. Unauthenticated remote attackers can write files outside the intended directory by exploiting insufficient path validation and symlink following via the output path parameter. This is achieved through symlink and time-of-check-time-of-use (TOCTOU) attacks—a race condition where a system checks a condition (such as a file path) and then uses the result, but the condition changes between the check and the use. This can lead to potential code execution if the runtime user has write access to executable or cron locations.

Recommendations Update to version 0.8.8 or later. Avoid using the output path parameter in the screenshot and PDF endpoints until the update is applied.