crawl4ai versions before 0.9.0 do not properly restrict the pathname used when saving downloaded files. The destination filename is derived from attacker-influenced input (HTTP response Content-Disposition filename or browser crawler's suggested filename) and joined to the downloads directory without confinement. This allows an attacker to specify absolute paths or path traversal sequences to write files outside the intended directory. Because the attacker controls the file contents, this vulnerability can escalate to remote code execution. The vulnerability is addressed in crawl4ai version 0.9.0.

An attacker can write arbitrary files with attacker-controlled content to any location accessible by the application, potentially leading to remote code execution. This compromises confidentiality, integrity, and availability of the affected system.

Upgrade crawl4ai to version 0.9.0 or later, where this path traversal vulnerability is fixed. No other mitigation or temporary workaround is indicated.