CVE-2026-26217: 
Python vulnerability analysis and mitigation

CVE-2026-26217 is a Local File Inclusion (LFI) vulnerability in Crawl4AI's Docker API deployment that allows unauthenticated remote attackers to read arbitrary files from the server filesystem. The vulnerability affects all Crawl4AI versions prior to 0.8.0, published by kidocode. It was discovered by Neo from ProjectDiscovery in December 2025 and disclosed on February 12, 2026, with a patch released in January 2026 as part of version 0.8.0. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 9.2 (Critical) (GitHub Advisory, Red Hat).

The root cause is improper input validation (CWE-22: Path Traversal) in the Crawl4AI Docker API endpoints /execute_js, /screenshot, /pdf, and /html, which fail to restrict accepted URL schemes. Attackers can supply file:// URLs in POST request bodies to these endpoints, causing the server to fetch and return the contents of arbitrary local files — effectively bypassing any intended restriction to web content. No authentication, privileges, or user interaction are required for exploitation. The fix in v0.8.0 implements URL scheme validation that only permits http://, https://, and raw: schemes (GitHub Advisory, Release Notes).

Successful exploitation allows an unauthenticated attacker to read arbitrary files from the Docker container's filesystem, including sensitive system files such as /etc/passwd, /etc/shadow, application configuration files, and environment variables via /proc/self/environ. This can expose credentials, API keys, and internal application structure, providing attackers with a foothold for further attacks against the system and any connected services. The impact is limited to confidentiality — there is no integrity or availability impact — but credential exposure could enable lateral movement into other systems (GitHub Advisory, Red Hat).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time, though a PoC reference was noted in a neo-pocs repository update (Feedly). The vulnerability is trivially exploitable — it requires only a crafted POST request with no authentication — making it highly automatable. The EPSS score is 0.062% (low probability of exploitation in the near term). The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was responsibly disclosed by Neo from ProjectDiscovery (GitHub Advisory, Release Notes).

1. Reconnaissance: Identify internet-exposed Crawl4AI Docker API instances using tools like Shodan or Censys, searching for the default API port or known Crawl4AI service banners. Confirm the version is prior to 0.8.0 if possible.
2. Identify vulnerable endpoints: Target any of the four affected endpoints: /execute_js, /screenshot, /pdf, or /html.
3. Craft malicious request: Send a POST request to the target endpoint with a file:// URL pointing to a sensitive file. For example:

POST /execute_js HTTP/1.1
Host: <target>
Content-Type: application/json

{"url": "file:///etc/passwd", "scripts": ["document.body.innerText"]}

4. Extract sensitive data: Parse the API response to retrieve the contents of the requested file. Repeat with other targets such as file:///etc/shadow, file:///proc/self/environ, or application-specific config files to harvest credentials and API keys.
5. Leverage obtained credentials: Use any discovered credentials or API keys to pivot into connected services or escalate access (GitHub Advisory, Release Notes).

• Network: Unexpected POST requests to /execute_js, /screenshot, /pdf, or /html endpoints containing file:// in the request body; outbound connections from the Crawl4AI container to unusual external IPs following API requests.
• Logs: API access logs showing POST requests to the above endpoints with file:/// URL patterns in the body (e.g., file:///etc/passwd, file:///proc/self/environ); repeated requests to these endpoints from a single source IP in a short timeframe.
• File System: No direct file system artifacts are expected from read-only LFI exploitation, but evidence of follow-on activity (new files, modified configs) may indicate credential reuse after exfiltration.
• Process: Unusual child processes or network connections spawned from the Crawl4AI Docker container following API activity (GitHub Advisory).

Upgrade Crawl4AI to version 0.8.0 or later, which blocks file:// URLs at all affected endpoints and restricts accepted schemes to http://, https://, and raw:. As immediate workarounds prior to patching: disable the Docker API if not required, restrict network access to the API to trusted networks only using firewall rules, and add authentication to the API. After patching, review and rotate any credentials, API keys, or sensitive information that may have been exposed. Users who legitimately need to process local files should use the Python library directly instead of the Docker API (GitHub Advisory, Release Notes).

The vulnerability was responsibly disclosed by Neo from ProjectDiscovery, who was credited in the Crawl4AI v0.8.0 release notes. Red Hat tracked the CVE and published an advisory. Security aggregators including The Hacker Wire, RedPacket Security, and Vulners covered the disclosure shortly after publication. The Mastodon/infosec.exchange community noted the vulnerability via the offseq account (Release Notes, Red Hat).