CVE-2026-91940
crawl4ai before 0.9.3 contains an arbitrary file write vulnerability in PDFContentScrapingStrategy where the _filter_untrusted_fields function fails to validate untrusted configuration fields. Attackers can submit crafted config bodies with malicious image_save_dir paths to write attacker-controlled bytes into any directory accessible to the service account.
- Published Sep 15, 2026
- CVSS 8.7 high
- 0.5% chance of exploitation in the next 30 days (EPSS)
- A fix is available