CVE-2026-56260

Name of the Vulnerable Software and Affected Versions Crawl4AI versions prior to 0.8.7

Description An arbitrary file write issue exists in the Docker API server. The '/screenshot' and '/pdf' endpoints do not validate the output path parameter, allowing the use of absolute paths or path-traversal values. This enables an attacker to write files to any location accessible by the application user, which can lead to the overwriting of server files, denial of service, or potential remote code execution.

Recommendations Update to version 0.8.7.