CVE-2026-26217

The record

Crawl4AI versions prior to 0.8.0 contain a local file inclusion vulnerability in the Docker API deployment. The /execute_js, /screenshot, /pdf, and /html endpoints accept file:// URLs, allowing unauthenticated remote attackers to read arbitrary files from the server filesystem. An attacker can access sensitive files such as /etc/passwd, /etc/shadow, application configuration files, and environment variables via /proc/self/environ, potentially exposing credentials, API keys, and internal application structure.

Affected packages

Related vulnerabilities

• GHSA-vx9w-5cx4-9796 Crawl4AI Has Local File Inclusion in Docker API via file:// URLs Same vulnerability
• CVE-2026-26216 Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the… Also affects crawl4ai
• GHSA-5882-5rx9-xgxp Crawl4AI is Vulnerable to Remote Code Execution in Docker API via Hooks Parameter Also affects crawl4ai
• CVE-2026-81163 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')… CWE-22
• CVE-2026-112049 Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in… CWE-22
• CVE-2026-112005 WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote… CWE-22
• CVE-2026-61702 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like… CWE-22
• CVE-2026-104871 The Angular SSR is a server-rise rendering tool for Angular applications. CWE-22