Is CVE-2026-91940 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-91940 being exploited in the wild.

How severe is CVE-2026-91940?

High severity, with a CVSS score of 7.5, published 15 September 2026.

Which products and versions are affected?

crawl4ai crawl4ai 0.9.0 to 0.9.2.

Is there a fix for CVE-2026-91940?

A patch was published on 2026-09-15: Version 0.9.3 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-91940 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-91940?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-91940: crawl4ai arbitrary file write in PDFContentScrapingStrategy

CVE-2026-91940 · Severity: high · CVSS 7.5 · Published 2026-09-15

crawl4ai is a web scraping library used to extract content from websites and PDFs. A flaw in its PDF image extraction feature allows attackers to write arbitrary files to any directory on the server by submitting a specially crafted request with a malicious image save path. This could lead to data corruption, service disruption, or enable further attacks depending on what directories are writable.

Quick answers

Is CVE-2026-91940 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-91940 being exploited in the wild.
How severe is CVE-2026-91940?: High severity, with a CVSS score of 7.5, published 15 September 2026.
Which products and versions are affected?: crawl4ai crawl4ai 0.9.0 to 0.9.2.
Is there a fix for CVE-2026-91940?: A patch was published on 2026-09-15: Version 0.9.3 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-91940 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-91940?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a path traversal / arbitrary file write flaw (CWE-22) in the PDFContentScrapingStrategy component. The _filter_untrusted_fields function in crawl4ai/async_configs.py fails to properly validate untrusted request-body configuration fields because PDFContentScrapingStrategy is in UNTRUSTED_ALLOWED_TYPES but has no entry in UNTRUSTED_FIELD_ALLOWLIST, causing all non-forbidden fields (including image_save_dir, save_images_locally, and extract_images) to pass through. When processing PDFs, the _extract_images function in crawl4ai/processors/pdf/processor.py constructs file paths using the attacker-controlled image_save_dir without path containment checks, writing the PDF's raw image stream to an attacker-chosen directory. The attack requires network-reachable authenticated access to submit a POST /crawl request with a malicious config; no user interaction or code execution is demonstrated. The vulnerability affects crawl4ai versions 0.9.0 through 0.9.2 and is patched in 0.9.3.

Affected products

crawl4ai crawl4ai 0.9.0 to 0.9.2

Timeline

2026-08-31: disclosed: GitHub Security Advisory GHSA-xpp7-j28w-2gvx published
2026-09-15: patched: Version 0.9.3 released with fix
2026-09-15: advisory: CVE-2026-91940 assigned and published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.