CVE-2026-91940

crawl4ai before 0.9.3 contains a path traversal / arbitrary file write flaw (CWE-22) in its PDFContentScrapingStrategy, where the _filter_untrusted_fields function fails to validate untrusted fields in submitted crawl configurations. An attacker supplies a crafted config body containing a malicious image_save_dir path, causing the service to write attacker-controlled bytes into any directory writable by the service account. Because the vector is network-reachable with no authentication, privileges, or user interaction required (CVSS 4.0: 8.7), any deployment that accepts crawl configurations from untrusted clients — such as publicly exposed crawl4ai API/server instances — is at risk of integrity compromise, including potential overwriting of application files or writing files that lead to further compromise. Users of the library who only process their own trusted configs are not directly exposed. No public proof of concept exists and the issue is not in the CISA KEV catalog, so exploitation is not known to be occurring in the wild.

What to do: Upgrade crawl4ai to version 0.9.3 or later, which validates untrusted configuration fields in PDFContentScrapingStrategy. If immediate upgrade is not possible, do not expose crawl4ai server/API endpoints to untrusted networks or users, and reject or sanitize path-bearing config fields such as image_save_dir. Additionally, run the service under a dedicated low-privilege account or container with a read-only filesystem except for designated scratch directories, and inspect existing deployments for unexpected files written outside expected output paths.