https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 16:00:22 +0000 https://cve.radiocsirt.org/vuln/cve-2026-26217 <p><strong>Affected:</strong> unclecode Crawl4AI</p> <p>Crawl4AI versions prior to 0.8.0 contain a local file inclusion vulnerability in the Docker API deployment. The /execute_js, /screenshot, /pdf, and /html endpoints accept file:// URLs, allowing unauthenticated remote attackers to read arbitrary files from the server filesystem. An attacker can access sensitive files such as /etc/passwd, /etc/shadow, application configuration files, and environment variables via /proc/self/environ, potentially exposing credentials, API keys, and internal application structure.</p> <p><strong>Affected:</strong> unclecode Crawl4AI</p> <p>Crawl4AI versions prior to 0.8.0 contain a local file inclusion vulnerability in the Docker API deployment. The /execute_js, /screenshot, /pdf, and /html endpoints accept file:// URLs, allowing unauthenticated remote attackers to read arbitrary files from the server filesystem. An attacker can access sensitive files such as /etc/passwd, /etc/shadow, application configuration files, and environment variables via /proc/self/environ, potentially exposing credentials, API keys, and internal application structure.</p> https://cve.radiocsirt.org/vuln/cve-2026-26217 https://cve.radiocsirt.org/vuln/ghsa-vx9w-5cx4-9796 <p><strong>Affected:</strong> PyPI: Crawl4AI</p> <p>A local file inclusion vulnerability exists in the Crawl4AI Docker API. The /execute_js, /screenshot, /pdf, and /html endpoints accept file:// URLs, allowing attackers to read arbitrary files from the server filesystem.</p> <p>Attack Vector: ```json POST /execute_js { &#34;url&#34;: &#34;file:///etc/passwd&#34;, &#34;scripts&#34;: [&#34;document.body.innerText&#34;] } ``` Impact</p> <p>An unauthenticated attacker can: - Read sensitive files (/etc/passwd, /etc/shadow, application configs) - Access environment variables via /proc/self/environ - Discover internal application structure - Potentially read credentials and API keys</p> <p>Workarounds</p> <p>1. Disable the Docker API 2. Add authentication to the API 3. Use network-level filtering</p> <p><strong>Affected:</strong> PyPI: Crawl4AI</p> <p>A local file inclusion vulnerability exists in the Crawl4AI Docker API. The /execute_js, /screenshot, /pdf, and /html endpoints accept file:// URLs, allowing attackers to read arbitrary files from the server filesystem.</p> <p>Attack Vector: ```json POST /execute_js { &#34;url&#34;: &#34;file:///etc/passwd&#34;, &#34;scripts&#34;: [&#34;document.body.innerText&#34;] } ``` Impact</p> <p>An unauthenticated attacker can: - Read sensitive files (/etc/passwd, /etc/shadow, application configs) - Access environment variables via /proc/self/environ - Discover internal application structure - Potentially read credentials and API keys</p> <p>Workarounds</p> <p>1. Disable the Docker API 2. Add authentication to the API 3. Use network-level filtering</p> https://cve.radiocsirt.org/vuln/ghsa-vx9w-5cx4-9796