CVE-2026-26217 is a critical CWE-22 path traversal vulnerability in unclecode's Crawl4AI product. Versions before 0.8.0 allow unauthenticated remote attackers to exploit the Docker API deployment by supplying file:// URLs to certain endpoints (/execute_js, /screenshot, /pdf, /html). This results in local file inclusion, enabling attackers to read arbitrary files on the server. Sensitive files such as /etc/passwd, /etc/shadow, application configuration files, and /proc/self/environ can be accessed, potentially exposing credentials, API keys, and internal application details. The vulnerability has a CVSS 4.0 score of 9.2, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality and security capabilities.

An attacker can remotely and without authentication read arbitrary files on the affected server. This includes highly sensitive system files and environment variables that may contain credentials and API keys. The exposure of such information can lead to further compromise of the system or related infrastructure. The vulnerability impacts confidentiality and security capabilities severely, as indicated by the CVSS score.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable endpoints and avoid exposing the Docker API deployment to untrusted networks. Monitor vendor channels for updates and apply any official fixes promptly once released.