CVE-2026-91940: Unclecode CRAWL4AI

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

crawl4ai before 0.9.3 contains an arbitrary file write vulnerability in PDFContentScrapingStrategy where the _filter_untrusted_fields function fails to validate untrusted configuration fields. Attackers can submit crafted config bodies with malicious image_save_dir paths to write attacker-controlled bytes into any directory accessible to the service account.

Affected products

• Unclecode CRAWL4AI: from 0.9.0, before 0.9.3 (fixed in 0.9.3)

Published 2026-09-15. Last modified 2026-09-16.