CVE-2026-57571: Kidocode Crawl4ai RCE Vulnerability

CVE-2026-57571 Overview

CVE-2026-57571 is a path traversal vulnerability in Crawl4AI, an open-source LLM-friendly web crawler and scraper maintained by kidocode. Versions prior to 0.9.0 accept attacker-influenced filenames when saving downloaded content. The library joins these filenames to the downloads directory without confinement, allowing absolute paths or .. sequences to escape the intended location. Both the HTTP crawler path (which uses the response Content-Disposition filename) and the browser crawler path (which uses the download's suggested filename) are affected. Because the written bytes are attacker-controlled, this arbitrary file write can escalate to remote code execution.

Critical Impact
A remote attacker who controls a target URL can write arbitrary files anywhere the Crawl4AI process has permission, leading to remote code execution.

Affected Products

Kidocode Crawl4AI versions prior to 0.9.0
Crawl4AI HTTP crawler component (uses Content-Disposition filename)
Crawl4AI browser crawler component (uses suggested download filename)

Discovery Timeline

2026-07-06 - CVE-2026-57571 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-57571

Vulnerability Analysis

Crawl4AI's download-handling logic constructs a destination path by joining the configured downloads directory with a filename taken from remote input. No normalization or containment check confines the result to the intended directory. When a filename contains an absolute path or traversal segments such as ../../, the write escapes the sandbox. The vulnerability is tracked as CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Because the file contents come directly from the HTTP response body, an attacker chooses both the path and the bytes. Writing to locations such as ~/.ssh/authorized_keys, cron directories, Python site-packages, or application startup scripts yields code execution on the host running the crawler.

Root Cause

The HTTP crawler path trusts the Content-Disposition header's filename parameter returned by the remote server. The browser crawler path trusts the suggested filename supplied by the browser download event, which itself is influenced by remote server headers. Both paths pass the untrusted string into a filesystem join operation without validating that the result stays within the downloads directory.

Attack Vector

An attacker hosts a malicious resource and induces a Crawl4AI deployment to crawl it. The server responds with a header such as Content-Disposition: attachment; filename="../../../../etc/cron.d/backdoor" and a payload body containing the desired file contents. The crawler resolves the filename outside the downloads directory and writes the attacker's bytes there. User interaction is limited to initiating a crawl against attacker-controlled or attacker-influenced content.

The fix in version 0.9.0 is part of a broader secure-by-default Docker server hardening release:

text

FROM python:3.12-slim-bookworm AS build

# C4ai version
-ARG C4AI_VER=0.8.9
+ARG C4AI_VER=0.9.0
ENV C4AI_VERSION=$C4AI_VER
LABEL c4ai.version=$C4AI_VER

Source: GitHub commit 60886d1a

Detection Methods for CVE-2026-57571

Indicators of Compromise

Files written outside the configured Crawl4AI downloads directory with recent modification timestamps matching crawl activity.
HTTP responses received by the crawler containing Content-Disposition headers with .., forward/backslash sequences, or absolute paths in the filename parameter.
New or modified files in sensitive locations such as ~/.ssh/, /etc/cron.d/, systemd unit directories, or Python site-packages on crawler hosts.
Unexpected child processes spawned by the Crawl4AI service account shortly after a crawl job completes.

Detection Strategies

Inspect Crawl4AI logs for download events where the resolved output path is not a subpath of the configured downloads directory.
Deploy filesystem integrity monitoring on hosts running Crawl4AI, alerting on writes by the crawler process to paths outside its working directory.
Add egress inspection to flag responses containing suspicious Content-Disposition filename values returned to crawler user agents.

Monitoring Recommendations

Enable audit logging (for example, auditd on Linux) for file creation events by the Crawl4AI user or container.
Correlate outbound crawl target URLs with subsequent file writes and process executions using an EDR or SIEM.
Track deployed Crawl4AI versions across the environment to identify hosts still running builds prior to 0.9.0.

How to Mitigate CVE-2026-57571

Immediate Actions Required

Upgrade Crawl4AI to version 0.9.0 or later on all crawler hosts and container images.
Restrict the set of URLs and domains that Crawl4AI is permitted to fetch, using an allowlist where feasible.
Run Crawl4AI under a dedicated low-privilege user or container with no write access to sensitive directories.
Audit the downloads directory and adjacent paths for files written prior to patching that may indicate exploitation.

Patch Information

The vulnerability is fixed in Crawl4AI 0.9.0. The upstream fix and secure-by-default Docker hardening are documented in GitHub Security Advisory GHSA-2jq4-q6vv-4cp3 and merged in commit 60886d1a. Users deploying the Docker image should pull the tag corresponding to C4AI_VER=0.9.0.

Workarounds

If immediate upgrade is not possible, run Crawl4AI inside a read-only container with only the downloads directory mounted as writable.
Apply mandatory access controls (AppArmor or SELinux) that confine the crawler process to a single writable directory.
Wrap or subclass the download handler to sanitize filenames, rejecting any value containing path separators or resolving outside the downloads root.

bash

# Upgrade Crawl4AI and verify the installed version
pip install --upgrade "crawl4ai>=0.9.0"
python -c "import crawl4ai; print(crawl4ai.__version__)"

# Docker: pull the patched image
docker pull unclecode/crawl4ai:0.9.0