CyberRota Analysis
AI-GeneratedAn arbitrary file write vulnerability exists in crawl4ai versions prior to 0.9.3, specifically in the PDFContentScrapingStrategy component, due to inadequate validation of untrusted configuration fields. This flaw allows attackers to exploit crafted configuration inputs to write malicious files to any directory accessible by the service account, potentially leading to unauthorized data manipulation or system compromise. Organizations using affected versions should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
crawl4ai before 0.9.3 contains an arbitrary file write vulnerability in PDFContentScrapingStrategy where the _filter_untrusted_fields function fails to validate untrusted configuration fields. Attackers can submit crafted config bodies with malicious image_save_dir paths to write attacker-controlled bytes into any directory accessible to the service account.