critical·Product Based Web Vulnerabilities·Updated Aug 18, 2026

Crawl4AI < 0.8.0 - Local File Inclusion

Run This Scanner →

Est. Time~10 seconds

Scan TypeGroup Scan

Targetsurl

CostFree

3.1k

Times Used

continuous scan runs

Continuously Checked

assets under CS

Vulnerabilities Found

confirmed findings

References

github.com↗

CVECVE-2026-26217

9.2

CVSScritical

Exploitable remotely over the internet · no authentication required.

Description

Crawl4AI versions prior to 0.8.0 contain a local file inclusion vulnerability in the Docker API deployment. The /execute_js, /screenshot, /pdf, and /html endpoints accept file:// URLs, allowing unauthenticated remote attackers to read arbitrary files from the server filesystem. An attacker can access sensitive files such as /etc/passwd, /etc/shadow, application configuration files, and environment variables via /proc/self/environ, potentially exposing credentials, API keys, and internal application structure.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

Affected

Crawl4AIby unclecode

AFFECTED< 0.8.0→SAFE ✓≥ 0.8.0

Updated Sep 18, 2026View on NVD →

Similar Tools

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.

Run This Scanner →Browse All Tools

Crawl4AI < 0.8.0 - Local File Inclusion

Check your infrastructure.Right now.

Check your infrastructure.
Right now.