CVE-2026-72904

Name of the Vulnerable Software and Affected Versions Firecrawl versions prior to 2.11.32

Description An arbitrary file read and Server-Side Request Forgery (SSRF) issue exists in the extraction functionality. The problem stems from unsafe schema dereferencing of user-supplied JSON schemas in the apps/api/src/lib/extract/helpers/dereference-schema.ts file. The system uses the json-schema-ref-parser dependency with default resolver settings, which allows the resolution of local and external file references. An authenticated attacker can provide a malicious schema containing a $ref within default, const, or enum fields that bypass AJV validation. By triggering a dereference error, the contents of files from the extract worker filesystem or responses from internal and external HTTP endpoints may be included in error messages returned via the extraction API.

Recommendations Update to version 2.11.32.