CVE-2026-91940
HIGH
NVD
CVSS Score
7.5
Severity
HIGH
Published
Sep 15, 2026
Vendor
unknown
Description
crawl4ai before 0.9.3 contains an arbitrary file write vulnerability in PDFContentScrapingStrategy where the _filter_untrusted_fields function fails to validate untrusted configuration fields. Attackers can submit crafted config bodies with malicious image_save_dir paths to write attacker-controlled bytes into any directory accessible to the service account.