Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Crawl4AI before 0.8.8 contains an arbitrary file write vulnerability in the screenshot and PDF endpoints that allows unauthenticated attackers to write files outside the intended directory via symlink and time-of-check-time-of-use (TOCTOU) attacks on the output_path parameter. Remote attackers can exploit insufficient path validation and symlink following to achieve arbitrary file write and potential code execution on systems where the runtime user has write access to executable or cron locations.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-56258 Arbitrary File Write Vulnerability in Crawl4AI Before 0.8.8 via Symlink Attacks https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-56258
Post summary
The post announces a new arbitrary file write vulnerability (CVE‑2026‑56258) in Crawl4AI versions before 0.8.8 that can be triggered through symlink attacks.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | kidocode | crawl4ai | - | - | - |