Crawl4AI: file:// URLs accepted by four endpoints let an unauthenticated caller read any file on the host

Impact

The /execute_js, /screenshot, /pdf and /html endpoints accept file:// URLs, so an unauthenticated caller turns the crawler into an arbitrary file reader against its own container. The advisory names /etc/passwd, /etc/shadow, application config and /proc/self/environ - which is where the API keys and model-provider credentials of an ingestion service live. This is a credential-theft primitive for the pipeline Crawl4AI feeds rather than code execution; it is a separate flaw from the hooks exec() issue (CVE-2026-26216) with its own advisory, though the same 0.8.0 release fixes both.

Who can reach it

Any unauthenticated client that can reach the Crawl4AI Docker API HTTP endpoint. No credentials required.

What to do

Upgrade to Crawl4AI 0.8.0 or later and redeploy the container - image pull plus daemon restart, no node drain. Assume any secret that was present in the container environment is disclosed if the endpoint was reachable from untrusted networks, and rotate it.

References

Related entries

• llama.cpp: use-after-free in the RPC server GRAPH_RECOMPUTE handler gives unauthenticated RCECVE-2026-39909 · llama.cpp RPC server (GRAPH_RECOMPUTE handler)Critical
• llama.cpp llama-server: use-after-free on the vocab pointer during idle sleep gives unauthenticated RCECVE-2026-43631 · llama.cpp llama-server (--sleep-idle-seconds idle transition)Critical
• gitlab-mcp: path traversal in job_id redirects API calls to arbitrary GitLab endpointsCVE-2026-61462 · zereight gitlab-mcp (MCP server, job_id parameter in build/index.js)Critical
• Ray (`/log_proxy`): SSRF from the dashboardCVE-2023-48023 · Ray (`/log_proxy`)Critical
• Qdrant (snapshot recovery): Arbitrary file read and write during snapshot recoveryCVE-2024-3829 · Qdrant (snapshot recovery)Critical
• ONNX (`download_model`): Arbitrary file overwriteCVE-2024-7776 · ONNX (`download_model`)Critical