CVE-2026-91940 in crawl4ai
Sumário
de MITRE • 15/09/2026
crawl4ai before 0.9.3 contains an arbitrary file write vulnerability in PDFContentScrapingStrategy where the _filter_untrusted_fields function fails to validate untrusted configuration fields. Attackers can submit crafted config bodies with malicious image_save_dir paths to write attacker-controlled bytes into any directory accessible to the service account.
VulDB is the best source for vulnerability data and more expert information about this specific topic.