CVE-2026-72904 in Firecrawl
Summary
by MITRE • 08/11/2026
Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to 2.11.32, a critical arbitrary file read vulnerability exists in Firecrawl's extraction functionality due to unsafe schema dereferencing of user-supplied JSON schemas in apps/api/src/lib/extract/helpers/dereference-schema.ts. The affected code invokes the json-schema-ref-parser dependency with default resolver settings, allowing external and local file references to be resolved during schema processing. An authenticated attacker can supply a malicious schema containing a $ref within default, const, or enum fields that are not traversed by AJV validation. By triggering a dereference error, file contents from the extract worker filesystem may be included in persisted error messages returned through the extraction API, enabling arbitrary file reads and SSRF against internal or external HTTP endpoints. This issue is fixed in version 2.11.32.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability in Firecrawl represents a critical arbitrary file read flaw that emerged from unsafe schema dereferencing practices within the extraction functionality of versions prior to 2.11.32. This security weakness resides in the apps/api/src/lib/extract/helpers/dereference-schema.ts file where the json-schema-ref-parser dependency is utilized with default resolver configurations that fail to properly validate or restrict external references. The fundamental technical flaw stems from the system's inability to distinguish between legitimate and malicious schema references, particularly when processing user-supplied JSON schemas during content extraction operations.
The operational impact of this vulnerability extends beyond simple data exposure as it enables authenticated attackers to craft malicious schemas containing specially crafted $ref entries within default, const, or enum fields that bypass AJV validation mechanisms. These fields are not traversed by AJV validation but remain susceptible to resolution during the schema dereferencing process. When such schemas are processed, the system triggers a dereference error that inadvertently includes file contents from the extract worker's filesystem within the error messages returned through the extraction API. This creates a pathway for arbitrary file reads that can access sensitive local files and potentially enable server-side request forgery attacks against internal or external HTTP endpoints.
This vulnerability aligns with CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and CWE-94 (Improper Control of Generation of Code) while mapping to ATT&CK technique T1059.001 (Command and Scripting Interpreter: PowerShell) and T1566 (Phishing). The attack vector leverages the trust model inherent in schema processing workflows where user-provided data is not adequately sanitized before being processed by core dependencies. The default resolver settings in json-schema-ref-parser create an insecure environment where external resource references can be resolved without proper authorization checks, allowing attackers to specify local file paths or network endpoints that should remain protected.
Organizations using Firecrawl versions prior to 2.11.32 face significant operational risks including potential exposure of sensitive configuration files, database connection strings, API keys, and other confidential information stored on the server filesystem. The vulnerability's authentication requirement reduces the attack surface compared to fully public exploits but still represents a critical risk for systems where user access is not properly restricted or monitored. The implementation of proper input validation and secure schema processing practices becomes essential to prevent attackers from exploiting this weakness through crafted malicious schemas.
The mitigation strategy involves updating to Firecrawl version 2.11.32 which addresses the vulnerability through improved resolver configurations that prevent unauthorized file access during schema dereferencing operations. Additional defensive measures include implementing strict schema validation policies, restricting external reference resolution capabilities, and monitoring extraction API calls for suspicious patterns. Organizations should also consider implementing network segmentation and access controls to limit potential lateral movement if an attacker successfully exploits this vulnerability in environments where multiple services share the same infrastructure. The fix demonstrates the importance of proper dependency management and secure coding practices when handling user-supplied data through schema processing workflows that involve external resource resolution.