Crawl4AI: Multiple Docker API Vulnerabilities - File Write, SSRF, Auth Bypass, XSS, JS Execution
Date: 2026-06
Affected: pip/crawl4ai
Attack vector: ssrf
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2026-56266
CWE: CWE-22
CWE-306
CWE-79
CWE-798
CWE-918
CWE-94
CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

### Summary Multiple security vulnerabilities in the Crawl4AI Docker API server affecting endpoints for crawling, markdown/LLM extraction, screenshots, PDFs, webhooks, monitoring, JavaScript execution, and configuration. ### Vulnerabilities #### 1. Arbitrary File Write via /screenshot and /pdf (CWE-22, CVSS 9.1) The `output_path` parameter accepts arbitrary filesystem paths with no validation. An attacker can overwrite server files (DoS) or write to any appuser-writable location. **Fix:** Added `validate_output_path()` restricting writes to `CRAWL4AI_OUTPUT_DIR` (/tmp/crawl4ai-outputs by default). Added Pydantic `field_validator` rejecting `..` traversal sequences. #### 2. SSRF via Webhook URL (CWE-918, CVSS 8.6) Webhook URLs in `/crawl/job` and `/llm/job` accept internal/private IPs with no validation, enabling Server-Side Request Forgery against cloud metadata endpoints (169.254.169.254), internal services, and Docker networks. **Fix:** Added `validate_webhook_url()` with blocklist for RFC 1918, loopback, link-local, cloud metadata IPs and hostnames. Validation at both job submission and send time. Explicit `follow_redirects=False`. #### 3. Authentication Bypass on Monitor Endpoints (CWE-306, CVSS 6.5) The monitor router was mounted without `token_dep` dependency, making all monitoring endpoints (including destructive ones like `/monitor/actions/cleanup`) accessible without authentication. **Fix:** Added `dependencies=[Depends(token_dep)]` to monitor router. Adde


Mitigations:

Architectural layers (MAESTRO):