CVE-2026-57571

Name of the Vulnerable Software and Affected Versions Crawl4AI versions prior to 0.9.0

Description An issue exists when the crawler saves downloaded files, as the destination filename is derived from attacker-influenced input and joined to the downloads directory without proper confinement. This allows for arbitrary file write with attacker-controlled contents via path traversal—a technique used to access files and directories outside the intended folder—by using an absolute path or traversal sequences. The HTTP crawler path utilizes the Content-Disposition filename, while the browser crawler path uses the suggested download filename. This flaw can lead to remote code execution, where an attacker can execute arbitrary commands on the host system.

Recommendations Update to version 0.9.0. Disable file saving as a temporary mitigation measure. Implement sandboxing to restrict the crawler's environment.