CVE-2026-91941

Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrapingStrategy that allows untrusted clients to cause denial of service. Attackers can select the PDF scraping strategy in POST requests to download large remote PDFs without size or page limits,...

CVE-2026-91943

Crawl4AI before 0.9.3 contains a server-side request forgery vulnerability in PDFContentScrapingStrategy where getpdfpath re-downloads targets with Python requests without egress validation. Authenticated attackers can supply URLs that redirect to internal addresses or use DNS rebinding to access...

CVE-2026-91940

crawl4ai before 0.9.3 contains an arbitrary file write vulnerability in PDFContentScrapingStrategy where the filteruntrustedfields function fails to validate untrusted configuration fields. Attackers can submit crafted config bodies with malicious imagesavedir paths to write attacker-controlled...

EUVD-2026-78800

Crawl4AI before 0.9.3 contains a server-side request forgery vulnerability in PDFContentScrapingStrategy where getpdfpath re-downloads targets with Python requests without egress validation. Authenticated attackers can supply URLs that redirect to internal addresses or use DNS rebinding to access...

CVE-2026-91943 Crawl4AI before 0.9.3 SSRF via PDFContentScrapingStrategy

Crawl4AI before 0.9.3 contains a server-side request forgery vulnerability in PDFContentScrapingStrategy where getpdfpath re-downloads targets with Python requests without egress validation. Authenticated attackers can supply URLs that redirect to internal addresses or use DNS rebinding to access...

CVE-2026-91943

Crawl4AI before 0.9.3 is affected by a server-side request forgery (SSRF) vulnerability in PDFContentScrapingStrategy , where the _get_pdf_path() function re-downloads targets using Python requests without egress validation. Authenticated attackers can supply URLs that redirect to internal networ...

CVE-2026-91943 Crawl4AI before 0.9.3 SSRF via PDFContentScrapingStrategy

Crawl4AI before 0.9.3 contains a server-side request forgery vulnerability in PDFContentScrapingStrategy where getpdfpath re-downloads targets with Python requests without egress validation. Authenticated attackers can supply URLs that redirect to internal addresses or use DNS rebinding to access...

CVE-2026-91943 Crawl4AI before 0.9.3 SSRF via PDFContentScrapingStrategy

Crawl4AI before 0.9.3 contains a server-side request forgery vulnerability in PDFContentScrapingStrategy where getpdfpath re-downloads targets with Python requests without egress validation. Authenticated attackers can supply URLs that redirect to internal addresses or use DNS rebinding to access...

CVE-2026-91940 crawl4ai before 0.9.3 Arbitrary File Write via PDFContentScrapingStrategy

crawl4ai before 0.9.3 contains an arbitrary file write vulnerability in PDFContentScrapingStrategy where the filteruntrustedfields function fails to validate untrusted configuration fields. Attackers can submit crafted config bodies with malicious imagesavedir paths to write attacker-controlled...

CVE-2026-91940 crawl4ai before 0.9.3 Arbitrary File Write via PDFContentScrapingStrategy

crawl4ai before 0.9.3 contains an arbitrary file write vulnerability in PDFContentScrapingStrategy where the filteruntrustedfields function fails to validate untrusted configuration fields. Attackers can submit crafted config bodies with malicious imagesavedir paths to write attacker-controlled...

CVE-2026-91941 Crawl4AI before 0.9.3 Denial of Service via PDFContentScrapingStrategy

Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrapingStrategy that allows untrusted clients to cause denial of service. Attackers can select the PDF scraping strategy in POST requests to download large remote PDFs without size or page limits,...

EUVD-2026-78798

Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrapingStrategy that allows untrusted clients to cause denial of service. Attackers can select the PDF scraping strategy in POST requests to download large remote PDFs without size or page limits,...

CVE-2026-91941

Crawl4AI before 0.9.3 is affected by an uncontrolled resource consumption vulnerability in the PDFContentScrapingStrategy component. An unauthenticated attacker can select the PDF scraping strategy in POST requests to trigger download of large remote PDFs without size or page limits , exhausting ...

CVE-2026-91940

crawl4ai before 0.9.3 is affected by an arbitrary file write vulnerability in the PDFContentScrapingStrategy component. The _filter_untrusted_fields function fails to validate untrusted configuration fields, allowing an attacker to submit crafted config bodies with malicious image_save_dir paths ...

EUVD-2026-78797

crawl4ai before 0.9.3 contains an arbitrary file write vulnerability in PDFContentScrapingStrategy where the filteruntrustedfields function fails to validate untrusted configuration fields. Attackers can submit crafted config bodies with malicious imagesavedir paths to write attacker-controlled...

CVE-2026-91940 crawl4ai before 0.9.3 Arbitrary File Write via PDFContentScrapingStrategy

crawl4ai before 0.9.3 contains an arbitrary file write vulnerability in PDFContentScrapingStrategy where the filteruntrustedfields function fails to validate untrusted configuration fields. Attackers can submit crafted config bodies with malicious imagesavedir paths to write attacker-controlled...

CVE-2026-91941 Crawl4AI before 0.9.3 Denial of Service via PDFContentScrapingStrategy

Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrapingStrategy that allows untrusted clients to cause denial of service. Attackers can select the PDF scraping strategy in POST requests to download large remote PDFs without size or page limits,...

CVE-2026-91941 Crawl4AI before 0.9.3 Denial of Service via PDFContentScrapingStrategy

Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrapingStrategy that allows untrusted clients to cause denial of service. Attackers can select the PDF scraping strategy in POST requests to download large remote PDFs without size or page limits,...

CVE-2026-91940: Improper Limitation of a Pathname to a Restricted Directory

crawl4ai before 0.9.3 contains an arbitrary file write vulnerability in PDFContentScrapingStrategy where the filteruntrustedfields function fails to validate untrusted configuration fields. Attackers can submit crafted config bodies with malicious imagesavedir paths to write attacker-controlled...

CVE-2026-91943: Server-Side Request Forgery (SSRF)

Crawl4AI before 0.9.3 contains a server-side request forgery vulnerability in PDFContentScrapingStrategy where getpdfpath re-downloads targets with Python requests without egress validation. Authenticated attackers can supply URLs that redirect to internal addresses or use DNS rebinding to access...