CVE-2026-91940 Overview
CVE-2026-91940 is an arbitrary file write vulnerability affecting crawl4ai versions prior to 0.9.3. The flaw resides in the PDFContentScrapingStrategy component, where the _filter_untrusted_fields function fails to validate untrusted configuration fields. Attackers can submit crafted configuration bodies containing a malicious image_save_dir path. This allows attacker-controlled bytes to be written into any directory accessible to the service account running the crawler. The vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.
Critical Impact
Unauthenticated network attackers can write arbitrary files to any location writable by the crawl4ai service account, enabling code execution paths, configuration tampering, and persistence.
Affected Products
- crawl4ai versions before 0.9.3
- Deployments using PDFContentScrapingStrategy with untrusted configuration input
- Services exposing crawl4ai configuration endpoints to network clients
Discovery Timeline
- 2026-09-15 - CVE-2026-91940 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-91940
Vulnerability Analysis
The vulnerability originates in the PDFContentScrapingStrategy class of crawl4ai, a Python library used for web crawling and content extraction. The strategy accepts configuration objects that specify where extracted PDF assets, including images, should be written to disk. The _filter_untrusted_fields function is responsible for sanitizing user-supplied configuration values before they reach file system operations. This filter does not validate the image_save_dir field against a safe base directory or reject path traversal sequences. As a result, an attacker who can submit configuration bodies to the crawler can direct writes to arbitrary filesystem locations. Details are published in the GitHub Security Advisory GHSA-xpp7-j28w-2gvx and the VulnCheck Advisory on Arbitrary File Write.
Root Cause
The root cause is insufficient input validation on the image_save_dir configuration field. _filter_untrusted_fields treats the field as trusted metadata rather than a sensitive filesystem parameter. No canonicalization or allow-list check is applied before the PDF scraping routine writes image bytes to the specified directory.
Attack Vector
An attacker submits a crafted crawl request or configuration body containing an image_save_dir value pointing outside the intended output directory. When the crawler processes a PDF, decoded image bytes are written to the attacker-chosen path. Targets include SSH authorized_keys files, cron directories, Python site-packages, and web server document roots, depending on the service account's permissions.
No verified public exploit code is available at this time. Refer to the security advisory for additional technical detail.
Detection Methods for CVE-2026-91940
Indicators of Compromise
- Unexpected files appearing in system directories such as /etc, /root/.ssh, /var/spool/cron, or Python site-packages shortly after crawl4ai processes external PDF content
- Configuration bodies submitted to crawl4ai endpoints containing image_save_dir values with .., absolute paths, or paths outside the expected output tree
- File writes performed by the crawl4ai service account outside its designated working directory
Detection Strategies
- Enable filesystem auditing (auditd on Linux) for write operations by the crawl4ai process user targeting sensitive directories
- Inspect application logs for PDFContentScrapingStrategy invocations and correlate with unusual output paths
- Deploy web application firewall rules that flag inbound JSON payloads containing image_save_dir fields with path traversal patterns
Monitoring Recommendations
- Alert on new executable, script, or SSH key files created by the crawl4ai service account
- Monitor process ancestry for shells spawned by the crawl4ai runtime, which may indicate follow-on code execution
- Track version inventory across environments to ensure all crawl4ai installations are at 0.9.3 or later
How to Mitigate CVE-2026-91940
Immediate Actions Required
- Upgrade crawl4ai to version 0.9.3 or later across all environments
- Audit accessible directories for unauthorized files created since crawl4ai was deployed
- Restrict network access to crawl4ai management and job submission endpoints to trusted clients only
- Run the crawl4ai service under a dedicated low-privilege user account with a narrowly scoped writable directory
Patch Information
The maintainers addressed CVE-2026-91940 in crawl4ai version 0.9.3. Upgrade using pip install --upgrade crawl4ai==0.9.3 or a later release. Review the GitHub Security Advisory GHSA-xpp7-j28w-2gvx for the full remediation notes.
Workarounds
- Reject or strip image_save_dir from any inbound configuration payloads at an application gateway or reverse proxy
- Disable PDFContentScrapingStrategy if PDF extraction is not required for the deployment
- Run crawl4ai inside a container or sandbox with read-only bind mounts for all sensitive host paths
- Apply mandatory access controls such as AppArmor or SELinux profiles restricting the crawl4ai process to an allow-listed output directory
# Configuration example: upgrade and constrain write access
pip install --upgrade 'crawl4ai>=0.9.3'
# Run under a dedicated user with a restricted output directory
useradd -r -s /usr/sbin/nologin crawl4ai
install -d -o crawl4ai -g crawl4ai -m 0750 /var/lib/crawl4ai/output
# systemd hardening excerpt
# [Service]
# User=crawl4ai
# ProtectSystem=strict
# ReadWritePaths=/var/lib/crawl4ai/output
# NoNewPrivileges=true
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
