Critical Arbitrary File Write Vulnerability in Crawl4AI (CVE-2026-56260)

CVE-2026-56260 is a critical arbitrary file write vulnerability affecting Crawl4AI versions prior to 0.8.7. This flaw exists in the Docker API server's /screenshot and /pdf endpoints, allowing unauthenticated attackers to write arbitrary files to any filesystem location accessible by the application's user. The vulnerability has a CVSS score of 9.1, indicating a high severity level. Currently, there are no known public proof-of-concept exploits, but the potential for denial of service and server file overwriting poses a significant risk. Users are advised to upgrade to version 0.8.7 or later to mitigate this issue. If immediate patching is not feasible, restricting access to the affected endpoints is recommended. The vulnerability was first published on July 12, 2026.

Key Points: • CVE-2026-56260 allows arbitrary file writes via Docker API endpoints in Crawl4AI. • The vulnerability has a CVSS score of 9.1, indicating critical severity. • Immediate patching to version 0.8.7 or later is strongly recommended.