Crawl4AI: Arbitrary file write (symlink/TOCTOU) plus log and webhook-header injection in Docker server
Summary
Three backward-compatible hardening fixes in the Docker API server. The headline issue is an arbitrary file write via the screenshot/PDF output_path.
1. Arbitrary file write via output_path symlink / TOCTOU (primary)
POST /screenshot and POST /pdf accept an output_path constrained to ALLOWED_OUTPUT_DIR by validate_output_path. The 0.8.7 check was string-only: it did not resolve symlinks, so a symlinked path component inside the output directory could redirect the write outside the directory, and the final open() followed symlinks. On a deployment where the runtime user can write executable/cron locations this is an arbitrary-write to code-execution primitive. The API is unauthenticated by default.
Fix: validate_output_path now resolves the real path (symlinks) of the parent and re-checks containment, and the write uses O_NOFOLLOW (write_output_file). output_path remains supported.
2. CRLF log injection (CWE-117)
User-controlled URLs/errors reflected into log lines could embed CR/LF and forge additional log entries. Fix: a logging filter strips CR/LF/control characters from all records.
3. Webhook request-header injection (CWE-93/CWE-113)
User-supplied webhook headers were sent verbatim, allowing CRLF and hop-by-hop / sensitive header injection on the outbound webhook request. Fix: webhook headers are validated (name pattern, no control characters, deny Host/Content-Length/Transfer-Encoding/Authorization/Cookie/...), with early request-time rejection.
Impact
Arbitrary file write (potential code execution) for #1; log forging for #2; request smuggling / header injection on outbound webhooks for #3.
Workarounds
- Upgrade to the patched version.
- Enable authentication (
CRAWL4AI_API_TOKEN). - Run the container with a read-only root filesystem.
Credits
Internal security audit (Crawl4AI maintainers).
Betroffene Software
Klicken Sie auf eine Technologie, um alle zugehörigen Schwachstellen anzuzeigen.
| Plattform | Paket | Anfällige Versionen | Behoben in |
|---|---|---|---|
| Python (PyPI) | crawl4ai | < 0.8.8 | 0.8.8 |
Verweise
- https://github.com/unclecode/crawl4ai/security/advisories/GHSA-7cx2-g3h9-382p
- https://www.vulncheck.com/advisories/crawl4ai-arbitrary-file-write-via-output-path-symlink-and-toctou
- https://github.com/unclecode/crawl4ai/issues/1
- https://github.com/unclecode/crawl4ai/issues/2
- https://github.com/unclecode/crawl4ai/pull/3
- https://github.com/pypa/advisory-database/tree/main/vulns/crawl4ai/PYSEC-2026-228.yaml
- https://github.com/unclecode/crawl4ai
- CVSS-Vektor
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H- Schwäche (CWE)
CWE-117, CWE-22, CWE-59, CWE-93- Plattform
- Python (PyPI)
- Paket
crawl4ai- Veröffentlicht
- 16.06.2026
- Aktualisiert
- 11.10.2026 14:18
Quellen und Lizenzen
OSV / GitHub Advisory Database - PYSEC-2026-228 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-7cx2-g3h9-382p - CC BY 4.0
Schwachstellenhistorie: crawl4ai
Alle veröffentlichten Schwachstellen dieses Pakets (Python (PyPI)), neueste zuerst. Zeigt, ob es ein einmaliger Ausrutscher ist oder ein Paket, das man im Auge behalten muss.
- Einträge insgesamt
- 12
- Erste → letzte
- 04.2025 06.2026
- Ohne Fix
- 1
- In Angriffen ausgenutzt
- 0
Verteilung nach Schweregrad
- Kritisch 6
- Hoch 5
- Mittel 1
Veröffentlichungen pro Jahr
- 2025: 1
- 2026: 11
-
Crawl4AI: Arbitrary file write (symlink/TOCTOU) plus log and webhook-header injection in Docker server dieser Eintrag
Erkennen Sie Schwachstellen in Ihrer Anwendung
Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.