CVE-2026-91940 in crawl4ai
Summary
by MITRE • 09/15/2026
crawl4ai before 0.9.3 contains an arbitrary file write vulnerability in PDFContentScrapingStrategy where the _filter_untrusted_fields function fails to validate untrusted configuration fields. Attackers can submit crafted config bodies with malicious image_save_dir paths to write attacker-controlled bytes into any directory accessible to the service account.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified in crawl4ai versions prior to 0.9.3 represents a critical security flaw within the PDFContentScrapingStrategy component, specifically rooted in inadequate input validation mechanisms. The core technical failure lies in the _filter_untrusted_fields function, which is designed to sanitize and validate configuration parameters before they are processed by the application logic. However, this filtering mechanism fails to properly enforce constraints on untrusted fields, particularly those related to file system operations such as image_save_dir paths. This oversight allows an attacker who can submit crafted configuration bodies to bypass security controls that should restrict where files are written within the host environment.
From a technical perspective, the flaw constitutes an arbitrary file write vulnerability, which is categorized under CWE-436: Interpretation Error and more specifically relates to CWE-22: Improper Limitation of a Pathname to a Restricted Directory when considering the path traversal aspect often associated with such misconfigurations in web applications. The attacker exploits this by injecting malicious paths into the configuration payload, effectively directing the application to write data outside of intended directories or directly into sensitive system locations accessible to the service account running the crawl4ai process. This capability stems from a lack of strict allow-listing for directory paths and insufficient normalization of user-supplied input before it is used in file I/O operations.
The operational impact of this vulnerability is severe, as it can lead to full remote code execution depending on the context in which the service account operates. If an attacker can write executable scripts or web shells into directories that are subsequently executed by a server process or served via a web interface, they gain persistent access to the underlying system. Even without direct code execution, arbitrary file writes can be used to overwrite critical configuration files, corrupt application data, or plant malicious artifacts for later exploitation. This significantly compromises the integrity and availability of the affected systems, potentially leading to broader network compromise if the service account has elevated privileges or access to other internal resources.
This vulnerability aligns with MITRE ATT&CK technique T1059: Command and Scripting Interpreter when considering potential follow-on actions such as executing uploaded scripts, and relates to T1105: Ingress Tool Transfer if used for deploying additional malicious tools. It also reflects common patterns found in CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) contextually through path manipulation that influences system behavior beyond simple file storage.
To mitigate this vulnerability, organizations must immediately upgrade crawl4ai to version 0.9.3 or later where the _filter_untrusted_fields function has been hardened with robust validation logic. Implementing strict allow-lists for directory paths is essential, ensuring that only predefined, safe directories are accepted as valid targets for file writes. Additionally, applying principle of least privilege to the service account running crawl4ai limits the potential damage by restricting write access to non-critical locations. Input sanitization should be enforced at multiple layers, including application-level validation and web server configuration, to prevent malformed or malicious payloads from reaching vulnerable code paths. Regular security audits and static analysis tools can help identify similar input handling weaknesses in other components of the application stack.