Executive brief
Crawl4AI is a tool used to automate web crawling and data extraction. A security flaw allows a malicious website to trick the crawler into writing files to sensitive locations on the server's hard drive instead of the intended download folder. This can allow an attacker to take full control of the server by overwriting critical system files or configuration settings.
Technical details
A path traversal vulnerability exists in Crawl4AI's `AsyncHTTPCrawlerStrategy` and `AsyncPlaywrightCrawlerStrategy` components. The crawler fails to sanitize filenames provided by the server via the `Content-Disposition` header or Playwright's `suggested_filename` property. An attacker-controlled web server can provide a filename containing absolute paths or traversal sequences (e.g., `../`), allowing the crawler to write files outside the designated downloads directory. By overwriting sensitive files such as `~/.ssh/authorized_keys`, cron jobs, or Python modules, an attacker can achieve remote code execution (RCE). The vulnerability is fixed in version 0.9.0 by implementing a hardened path resolution helper that enforces basename-only filenames and validates the final path using `realpath`.
Affected products
- unclecode crawl4ai <= 0.8.9
Timeline
- 2026-06-18: advisory: GHSA-2jq4-q6vv-4cp3 published
- 2026-06-18: patched: Version 0.9.0 released