# CVE-2026-91940: crawl4ai arbitrary file write in PDFContentScrapingStrategy

Source: https://junglewise.ai/threats/cve-2026-91940-crawl4ai-arbitrary-file-write-in-pdfcontentscrapingstrategy  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-91940 · Severity: high · CVSS 7.5 · Published 2026-09-15

crawl4ai is a web scraping library used to extract content from websites and PDFs. A flaw in its PDF image extraction feature allows attackers to write arbitrary files to any directory on the server by submitting a specially crafted request with a malicious image save path. This could lead to data corruption, service disruption, or enable further attacks depending on what directories are writable.

## Quick answers

**Is CVE-2026-91940 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-91940 being exploited in the wild.

**How severe is CVE-2026-91940?** High severity, with a CVSS score of 7.5, published 15 September 2026.

**Which products and versions are affected?** crawl4ai crawl4ai 0.9.0 to 0.9.2.

**Is there a fix for CVE-2026-91940?** A patch was published on 2026-09-15: Version 0.9.3 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-91940 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-91940?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a path traversal / arbitrary file write flaw (CWE-22) in the PDFContentScrapingStrategy component. The _filter_untrusted_fields function in crawl4ai/async_configs.py fails to properly validate untrusted request-body configuration fields because PDFContentScrapingStrategy is in UNTRUSTED_ALLOWED_TYPES but has no entry in UNTRUSTED_FIELD_ALLOWLIST, causing all non-forbidden fields (including image_save_dir, save_images_locally, and extract_images) to pass through. When processing PDFs, the _extract_images function in crawl4ai/processors/pdf/processor.py constructs file paths using the attacker-controlled image_save_dir without path containment checks, writing the PDF's raw image stream to an attacker-chosen directory. The attack requires network-reachable authenticated access to submit a POST /crawl request with a malicious config; no user interaction or code execution is demonstrated. The vulnerability affects crawl4ai versions 0.9.0 through 0.9.2 and is patched in 0.9.3.

## Affected products

- crawl4ai crawl4ai 0.9.0 to 0.9.2

## Timeline

- 2026-08-31: disclosed: GitHub Security Advisory GHSA-xpp7-j28w-2gvx published
- 2026-09-15: patched: Version 0.9.3 released with fix
- 2026-09-15: advisory: CVE-2026-91940 assigned and published on NVD

## References

- [https://github.com/unclecode/crawl4ai/security/advisories/GHSA-xpp7-j28w-2gvx](https://github.com/unclecode/crawl4ai/security/advisories/GHSA-xpp7-j28w-2gvx)
- [https://www.vulncheck.com/advisories/crawl4ai-before-0.9.3-arbitrary-file-write-via-pdfcontentscrapingstrategy](https://www.vulncheck.com/advisories/crawl4ai-before-0.9.3-arbitrary-file-write-via-pdfcontentscrapingstrategy)