CVE-2026-82286: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in BuilderIO gpt-crawler

The gpt-crawler product from BuilderIO, versions up to and including 1.5.1, contains a path traversal vulnerability due to improper limitation of the outputFileName parameter in the POST /crawl endpoint. This allows unauthenticated attackers to specify arbitrary filesystem paths, including absolute paths and parent-directory references, enabling them to write or overwrite files with data fetched from attacker-controlled URLs. This vulnerability can lead to unauthorized file modification on the affected system.

An unauthenticated attacker can write arbitrary files anywhere on the filesystem accessible to the application, potentially overwriting critical files. This can lead to system compromise, data corruption, or denial of service depending on which files are overwritten. The CVSS 4.0 base score is 8.8 (high), reflecting the network attack vector, no required privileges or user interaction, and significant impact on integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the POST /crawl endpoint and monitor for suspicious requests attempting path traversal patterns in the outputFileName parameter.