CVE-2026-57571

Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, when the crawler saves a downloaded file, the destination filename was taken from attacker-influenced input and joined to the downloads directory with no confinement. A filename containing an absolute path or traversal escaped the downloads directory, giving an arbitrary file write with attacker-controlled contents; the HTTP crawler path uses the response Content-Disposition filename and the browser crawler path uses the download's suggested filename. Because the written bytes are attacker-controlled, this can escalate to remote code execution. This issue is fixed in version 0.9.0.

• CWE-22
• CWE-59

• https://github.com/unclecode/crawl4ai/commit/60886d1a0c52682e4c83a7cef9dfac417fff6bd2Patch
• https://github.com/unclecode/crawl4ai/security/advisories/GHSA-2jq4-q6vv-4cp3Mitigation, Vendor Advisory, Exploit

Published

Jul 6, 2026

Last Modified

Jul 7, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-57535Content injected to PDF rendering contexts could, in many pl…2.1
• CVE-2026-57536Our payment integration with Mollie did not properly validat…6.3
• CVE-2026-5754Reflected Cross-Site Scripting (XSS) Vulnerability in Radwar…6.1
• CVE-2026-5755Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.2, 11.5…6.5
• CVE-2026-5756Unauthenticated Configuration File Modification Vulnerabilit…7.5
• CVE-2026-5757Unauthenticated remote information disclosure vulnerability …7.5
• CVE-2026-57572Crawl4AI is an open-source LLM-friendly web crawler and scra…10
• CVE-2026-57573Crawl4AI is an open-source LLM-friendly web crawler and scra…8.6
• CVE-2026-57574Misskey is an open source, federated social media platform. …7.4
• CVE-2026-57575Misskey is an open source, federated social media platform. …6.9
• CVE-2026-5758JavaScript is vulnerable to prototype pollution in Mafintosh…6.5
• CVE-2026-57584Phalcon is a high-performance, full-stack PHP framework. Pri…8.7