CVE-2026-56258: Crawl4AI - Arbitrary File Write via output_path Symlink and TOCTOU

Synopsis

An arbitrary file write vulnerability exists in Crawl4AI before version 0.8.8, affecting the screenshot and PDF output endpoints. The flaw is reachable over the network with no authentication required: an attacker supplies a crafted output_path value, then exploits insufficient path validation combined with a symlink and a time-of-check-time-of-use (TOCTOU) race to write files outside the intended directory. Successful exploitation enables arbitrary file write on the host, and on systems where the runtime user has write access to executable or cron locations, this escalates to remote code execution. A patched-image rebuild at version 0.8.8 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable screenshot and PDF endpoints are exposed over the network, so an attacker must be able to reach the service remotely to supply a malicious output_path value.

• AuthenticationNot required

  No credentials or session token are needed; the endpoints accept unauthenticated requests, giving any network-reachable attacker direct access.

• Victim interactionNot required

  Exploitation is fully attacker-driven and requires no action from a user or administrator on the target system.

• Attack complexityDetail

  Exploitation is conditionally complex: the attacker must win a TOCTOU race and plant a symlink at the right moment, and the CVSS vector notes a specific prerequisite condition (AT:P), making reliable exploitation dependent on timing and local filesystem state.

Blast Radius

• The attacker writes arbitrary file content to any path the runtime user can reach on the host filesystem, overwriting or creating files outside the intended output directory.
• On systems where the runtime user has write access to executable paths, cron directories, or init scripts, the attacker plants a malicious file that executes with the privileges of that runtime user.
• Confidentiality of existing files is compromised if the attacker overwrites configuration files, credential stores, or private keys by replacing them through the symlink chain.
• Availability of the affected service and dependent processes is disrupted if critical runtime files are corrupted or replaced with non-functional content.