CVE-2026-57571

{
  "id": "CVE-2026-57571",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-06T21:16:57.907",
  "lastModified": "2026-10-25T20:10:00.147",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, when the crawler saves a downloaded file, the destination filename was taken from attacker-influenced input and joined to the downloads directory with no confinement. A filename containing an absolute path or traversal escaped the downloads directory, giving an arbitrary file write with attacker-controlled contents; the HTTP crawler path uses the response Content-Disposition filename and the browser crawler path uses the download's suggested filename. Because the written bytes are attacker-controlled, this can escalate to remote code execution. This issue is fixed in version 0.9.0."
    },
    {
      "lang": "es",
      "value": "Crawl4AI es un rastreador y extractor web de código abierto compatible con LLM. Antes de la versión 0.9.0, cuando el rastreador guardaba un archivo descargado, el nombre del archivo de destino se tomaba de una entrada influenciada por el atacante y se unía al directorio de descargas sin confinamiento. Un nombre de archivo que contenía una ruta absoluta o de recorrido escapaba del directorio de descargas, permitiendo una escritura de archivo arbitraria con contenido controlado por el atacante; la ruta del rastreador HTTP utiliza el nombre de archivo Content-Disposition de la respuesta y la ruta del rastreador del navegador utiliza el nombre de archivo sugerido de la descarga. Dado que los bytes escritos están controlados por el atacante, esto puede escalar a ejecución remota de código. Este problema se solucionó en la versión 0.9.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "unclecode",
          "product": "crawl4ai",
          "versions": [
            {
              "version": "< 0.9.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
          "baseScore": 9.6,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-07T14:53:33.142454Z",
          "id": "CVE-2026-57571",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-59"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:kidocode:crawl4ai:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "0.9.0",
              "matchCriteriaId": "E7ED5B79-F478-4E2C-B384-BA572D992FAA"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/unclecode/crawl4ai/commit/60886d1a0c52682e4c83a7cef9dfac417fff6bd2",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/unclecode/crawl4ai/security/advisories/GHSA-2jq4-q6vv-4cp3",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Vendor Advisory",
        "Exploit"
      ]
    }
  ]
}