p PatchFirst

CVE-2026-26217

CVE-2026-26217 · Crawl4AI < 0.8.0 Docker API Local File Inclusion via file URL Handling

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Crawl4AI versions prior to 0.8.0 contain a local file inclusion vulnerability in the Docker API deployment. The /execute_js, /screenshot, /pdf, and /html endpoints accept file:// URLs, allowing unauthenticated remote attackers to read arbitrary files from the server filesystem. An attacker can access sensitive files such as /etc/passwd, /etc/shadow, application configuration files, and environment variables via /proc/self/environ, potentially exposing credentials, API keys, and internal application structure.

CVSS 9.2 · Critical · EPSS 2.1% · Public exploit · Fix available

Published
Updated

Stack: python

Affected products and versions

  • crawl4ai

    Versions
    • ≥ 0, < 0.8.0: Affected (semver)

    Update to 0.8.0

  • crawl4ai PyPI

    Versions
    • 0.3.0
    • 0.3.1
    • 0.3.2
    • 0.3.3
    • 0.3.4
    • 0.3.5
    • 0.3.6
    • 0.3.7
    • 0.3.71
    • 0.3.72
    • 0.3.73
    • 0.3.731
    • 0.3.74
    • 0.3.741
    • 0.3.742
    • 0.3.743
    • 0.3.744
    • 0.3.745
    • 0.3.746
    • 0.3.8
    • 0.4.0
    • 0.4.1
    • 0.4.21
    • 0.4.22
    • 0.4.23
    • 0.4.24
    • 0.4.241
    • 0.4.242
    • 0.4.243
    • 0.4.244
    • 0.4.245
    • 0.4.246
    • 0.4.247
    • 0.4.248
    • 0.4.248b3
    • 0.4.3b1
    • 0.4.3b2
    • 0.4.3b3
    • 0.5.0
    • 0.5.0.post1
    • 0.5.0.post2
    • 0.5.0.post3
    • 0.5.0.post4
    • 0.5.0.post5
    • 0.5.0.post6
    • 0.5.0.post7
    • 0.5.0.post8
    • 0.6.0
    • 0.6.0rc1
    • 0.6.1
    • 0.6.2
    • 0.6.3
    • 0.7.0
    • 0.7.1
    • 0.7.2
    • 0.7.3
    • 0.7.4
    • 0.7.5
    • 0.7.6
    • 0.7.7
    • 0.7.8
    Affected ranges
    • ECOSYSTEM: < 0.8.0

    Update to 0.8.0

Original sources

Check your server →