Executive brief
crawl4ai is a web scraping library used to extract content from websites and PDFs. A flaw in its PDF image extraction feature allows attackers to write arbitrary files to any directory on the server by submitting a specially crafted request with a malicious image save path. This could lead to data corruption, service disruption, or enable further attacks depending on what directories are writable.
Technical details
The vulnerability is a path traversal / arbitrary file write flaw (CWE-22) in the PDFContentScrapingStrategy component. The _filter_untrusted_fields function in crawl4ai/async_configs.py fails to properly validate untrusted request-body configuration fields because PDFContentScrapingStrategy is in UNTRUSTED_ALLOWED_TYPES but has no entry in UNTRUSTED_FIELD_ALLOWLIST, causing all non-forbidden fields (including image_save_dir, save_images_locally, and extract_images) to pass through. When processing PDFs, the _extract_images function in crawl4ai/processors/pdf/processor.py constructs file paths using the attacker-controlled image_save_dir without path containment checks, writing the PDF's raw image stream to an attacker-chosen directory. The attack requires network-reachable authenticated access to submit a POST /crawl request with a malicious config; no user interaction or code execution is demonstrated. The vulnerability affects crawl4ai versions 0.9.0 through 0.9.2 and is patched in 0.9.3.
Affected products
- crawl4ai crawl4ai 0.9.0 to 0.9.2
Timeline
- 2026-08-31: disclosed: GitHub Security Advisory GHSA-xpp7-j28w-2gvx published
- 2026-09-15: patched: Version 0.9.3 released with fix
- 2026-09-15: advisory: CVE-2026-91940 assigned and published on NVD