CVE-2026-56258

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-56258
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56258.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-56258
Aliases
Published
2026-06-23T12:12:59.326Z
Modified
2026-07-16T03:31:12.748445155Z
Severity
  • 9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Crawl4AI - Arbitrary File Write via output_path Symlink and TOCTOU
Details

Crawl4AI before 0.8.8 contains an arbitrary file write vulnerability in the screenshot and PDF endpoints that allows unauthenticated attackers to write files outside the intended directory via symlink and time-of-check-time-of-use (TOCTOU) attacks on the output_path parameter. Remote attackers can exploit insufficient path validation and symlink following to achieve arbitrary file write and potential code execution on systems where the runtime user has write access to executable or cron locations.

Database specific 
{
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56258.json",
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/unclecode/crawl4ai

Affected ranges

Type
GIT
Repo
https://github.com/unclecode/crawl4ai
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
930dc0a61fe65c1e063df05792ffdf971d074674
Database specific 
{
    "cpe": "cpe:2.3:a:kidocode:crawl4ai:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.8.8"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

0.*
0.3.4
docker-rebuild-v0.*
docker-rebuild-v0.8.6
docker-rebuild-v0.8.7
v.*
v.3.72
v0.*
v0.0.75
v0.1.0
v0.2.0
v0.2.1
v0.2.4
v0.2.6
v0.2.7
v0.2.71
v0.2.72
v0.2.73
v0.2.74
v0.2.77
v0.3.0
v0.3.3
v0.3.6
v0.3.745
v0.4.24
v0.4.243
v0.5.0.post1
v0.6.3
v0.7.0
v0.7.1
v0.7.2
v0.7.3
v0.7.4
v0.8.6
v0.8.7
vr0.*
vr0.6.0
vr0.6.0rc1
vr0.6.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56258.json"