CVE-2026-82286: gpt-crawler Path Traversal Vulnerability

CVE-2026-82286 Overview

CVE-2026-82286 is an arbitrary file write vulnerability in gpt-crawler through version 1.5.1. The application fails to validate the outputFileName parameter in the POST /crawl endpoint. Unauthenticated attackers can supply absolute paths or parent-directory traversal sequences to write files anywhere on the target filesystem. The written content is sourced from attacker-controlled URLs, meaning both the destination path and the file contents are attacker-controlled. This maps to [CWE-22] Improper Limitation of a Pathname to a Restricted Directory (Path Traversal).

Critical Impact
Unauthenticated remote attackers can overwrite arbitrary files with attacker-controlled content, enabling configuration tampering, code injection into interpreted files, and potential remote code execution.

Affected Products

gpt-crawler versions through 1.5.1
BuilderIO gpt-crawler POST /crawl API endpoint
Any deployment exposing the crawler HTTP server to untrusted networks

Discovery Timeline

2026-08-28 - CVE-2026-82286 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82286

Vulnerability Analysis

The gpt-crawler project exposes an HTTP API that accepts crawl jobs through the POST /crawl endpoint. The request body includes an outputFileName field that determines where crawled content is persisted on disk. The server concatenates this value into a filesystem path without normalization, canonicalization, or allow-list validation.

Because the parameter accepts absolute paths such as /etc/cron.d/payload and relative traversal sequences such as ../../../root/.ssh/authorized_keys, an attacker can escape the intended output directory. The crawl operation then fetches content from a URL that the attacker also controls in the request. The result is a primitive that writes arbitrary bytes to any path writable by the crawler process. When the process runs as a privileged user or inside a container with broad mount access, the impact extends across the host.

Root Cause

The root cause is missing input validation on the outputFileName parameter in the crawl request handler. The code does not enforce that the resolved path stays within a designated output directory, and it does not reject path separators, drive letters, or parent-directory segments. Sink-side write operations trust the caller-supplied filename.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a single crafted POST /crawl request containing a malicious url and an outputFileName value with traversal sequences or an absolute path. The server fetches the URL and writes the response body to the attacker-chosen location. See the VulnCheck Advisory on GPT Crawler and GitHub Issue #418 for reproduction details. Verified proof-of-concept code is not reproduced here.

Detection Methods for CVE-2026-82286

Indicators of Compromise

HTTP requests to /crawl containing outputFileName values with ../, ..\, absolute paths starting with /, or Windows drive letters such as C:\.
Newly created or modified files outside the configured crawler output directory, particularly in /etc, /root, ~/.ssh, cron directories, or web server document roots.
Outbound HTTP fetches by the crawler process to unexpected attacker-controlled domains immediately preceding suspicious file writes.

Detection Strategies

Inspect reverse-proxy and application logs for POST /crawl bodies containing path separators or traversal tokens in the outputFileName field.
Deploy file integrity monitoring on sensitive directories on hosts running gpt-crawler and alert on writes originating from the Node.js process.
Correlate outbound crawl requests with subsequent filesystem writes to detect the fetch-then-write exploitation pattern.

Monitoring Recommendations

Log full request bodies for the /crawl endpoint at the ingress layer for retrospective analysis.
Enable process-level auditing (auditd, Sysmon FileCreate) for the account running gpt-crawler.
Alert on any child processes spawned by the crawler, which may indicate a file write leading to code execution.

How to Mitigate CVE-2026-82286

Immediate Actions Required

Restrict network access to the gpt-crawler HTTP server so it is not reachable from untrusted networks, and place it behind authenticated proxies.
Run the crawler as a low-privilege user in a container with a read-only root filesystem and a single writable output volume.
Audit filesystem contents on exposed hosts for unauthorized writes outside the crawler output directory since deployment.

Patch Information

At the time of publication, no fixed release is enumerated in the advisory metadata. Monitor the GitHub GPT Crawler Repository and GitHub Issue #418 for a patched version above 1.5.1. Review changes to src/core.ts and src/config.ts for validation logic on outputFileName.

Workarounds

Add a reverse-proxy rule that rejects POST /crawl requests whose JSON body contains ../, ..\, leading /, or drive-letter patterns in outputFileName.
Fork or patch the handler to call path.basename(outputFileName) and resolve the final path with path.resolve(outputDir, safeName), then verify the resolved path starts with the canonical outputDir.
Disable or firewall the /crawl endpoint entirely if the API is not required for the deployment.

bash

# Nginx snippet to block traversal patterns in outputFileName
location = /crawl {
    if ($request_body ~* "\"outputFileName\"\s*:\s*\"[^\"]*(\.\./|\.\.\\\\|^/|[A-Za-z]:\\\\)") {
        return 400;
    }
    proxy_pass http://gpt_crawler_upstream;
}