Description

crawl4ai before 0.9.3 contains an arbitrary file write vulnerability in PDFContentScrapingStrategy where the _filter_untrusted_fields function fails to validate untrusted configuration fields. Attackers can submit crafted config bodies with malicious image_save_dir paths to write attacker-controlled bytes into any directory accessible to the service account.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-15T16:17:45.460Z",
  "pubdate": "2026-09-15T16:17:45.460Z",
  "executiveSummary": "A critical arbitrary file write vulnerability exists in crawl4ai versions prior to 0.9.3, specifically within the PDFContentScrapingStrategy component. The vulnerability arises from improper validation of untrusted configuration fields, allowing an attacker to manipulate the file system path during the image saving process.\nBy providing a crafted configuration body containing a malicious 'image_save_dir' path, an attacker can coerce the application to write files to arbitrary locations within the server's file system, constrained only by the permissions of the service account running the crawl4ai process.\nThis vulnerability poses a severe security risk, as it potentially enables remote code execution (RCE) via techniques such as overwriting configuration files, injecting malicious scripts into web-accessible directories, or tampering with sensitive system files. Successful exploitation requires the ability to submit a malicious configuration to the scraping strategy, making the impact dependent on the exposure of the crawl4ai interface to untrusted inputs. Organizations utilizing affected versions are at significant risk of system compromise and should prioritize upgrading to version 0.9.3 or later.",
  "technicalDetails": "The root cause of this vulnerability is a lack of input sanitization and path validation within the '_filter_untrusted_fields' function of the 'PDFContentScrapingStrategy' class in crawl4ai. This function is responsible for parsing configuration data provided during the scraping process. Because the implementation fails to enforce strict constraints or whitelist directories for file operations, it inadvertently allows user-supplied data to influence the 'image_save_dir' parameter.\nIn the context of the 'PDFContentScrapingStrategy', the application is designed to extract images from PDF documents and store them locally. The 'image_save_dir' parameter dictates the destination directory for these extracted artifacts. When the '_filter_untrusted_fields' function processes a malicious payload, it fails to verify that the path provided in 'image_save_dir' is rooted in a safe, expected base directory. Consequently, an attacker can utilize path traversal sequences (e.g., '../../') to escape the designated storage directory and direct the application to write files to sensitive locations.\nThe attack flow follows a structured path: First, the attacker identifies an entry point where they can influence the 'crawl4ai' configuration body, such as an API endpoint or a configuration upload feature. Second, the attacker crafts a payload that includes a malicious 'image_save_dir' string. This string is designed to target a specific system path or a web-accessible directory. Third, the attacker initiates a scraping request with this configuration, causing the 'PDFContentScrapingStrategy' to initialize using the attacker's path. Finally, when the strategy processes a PDF and extracts images, it attempts to write these files to the attacker-defined directory. The application, operating with the privileges of the underlying service account, proceeds to write the file, effectively executing the arbitrary file write.\nThe impact of this vulnerability is contingent on the service account's permissions. If the service account has write access to critical locations, such as '/etc/', '/var/www/', or application-specific configuration files, the attacker can achieve persistent unauthorized access, system degradation, or complete server compromise. The vulnerability affects all versions of crawl4ai prior to 0.9.3 and does not inherently require authentication if the interface accepting the configuration is exposed to the network."
}