Executive brief
Crawl4AI is an open-source tool used to scrape and crawl web content for use with Large Language Models (LLMs). A security flaw allows a malicious website to control the name and location of files downloaded by the crawler, potentially allowing the attacker to overwrite sensitive system files. This can lead to a total system takeover or remote code execution if the attacker overwrites critical configuration or startup files.
Technical details
A path traversal vulnerability exists in the download handling logic of both the HTTP and Browser crawler strategies in Crawl4AI. In the HTTP crawler (AsyncHTTPCrawlerStrategy), the filename is extracted from the 'Content-Disposition' header, while the Browser crawler (AsyncPlaywrightCrawlerStrategy) uses the 'suggested_filename' provided by the browser. Because these inputs were joined to the download directory without proper sanitization or confinement, an attacker-controlled website could provide a filename containing absolute paths or traversal sequences (e.g., '../../etc/cron.d/evil'). This allows for arbitrary file writes with attacker-controlled content, which can be leveraged for remote code execution by overwriting SSH keys, cron jobs, or Python modules. The issue is fixed in version 0.9.0 by implementing a hardened path resolution helper that enforces basename-only filenames and validates the final path using realpath.
Affected products
- unclecode crawl4ai <= 0.8.9
Timeline
- 2026-06-18: patched: Fixed in version 0.9.0
- 2026-07-06: disclosed: CVE-2026-57571 published