CVE-2026-91940
Received Received - Intake

Arbitrary File Write in crawl4ai via Untrusted PDF Content Scraping

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulnCheck

Description
crawl4ai before 0.9.3 contains an arbitrary file write vulnerability in PDFContentScrapingStrategy where the _filter_untrusted_fields function fails to validate untrusted configuration fields. Attackers can submit crafted config bodies with malicious image_save_dir paths to write attacker-controlled bytes into any directory accessible to the service account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-91940
EUVD
EUVD-2026-78797

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

crawl4ai before version 0.9.3 has an arbitrary file write vulnerability in the PDFContentScrapingStrategy component. The _filter_untrusted_fields function fails to validate untrusted configuration fields, allowing attackers to specify malicious image_save_dir paths. This can lead to writing attacker-controlled data to any directory accessible by the service account.

Detection Guidance

Check crawl4ai version with pip show crawl4ai. If version is below 0.9.3, the system is vulnerable. Monitor for unexpected file writes in directories accessible to the service account.

Impact Analysis

An attacker could overwrite critical system files, inject malicious content into applications, or manipulate configuration files. This may cause service disruption, data corruption, or unauthorized access to sensitive information depending on the service account's permissions.

Compliance Impact

This vulnerability could lead to unauthorized file modifications, potentially violating data integrity and confidentiality requirements under GDPR and HIPAA. Unauthorized file writes may result in non-compliance with access control and audit logging mandates.

Mitigation Strategies

Upgrade crawl4ai to version 0.9.3 or later immediately. If upgrading is not possible, restrict write permissions for the service account and block untrusted PDF processing until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91940. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart