CVE-2026-56260 describes an arbitrary file write vulnerability in Crawl4AI prior to version 0.8.7. The Docker API server exposes /screenshot and /pdf endpoints that accept an output_path parameter. Due to lack of validation on this parameter, an attacker can supply absolute or path-traversal paths to write files anywhere writable by the application user. This can overwrite critical server files and result in denial of service conditions. The vulnerability is categorized under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). No known exploits are reported in the wild. No patch or remediation information is currently provided.

An attacker can write arbitrary files to any location writable by the application user, potentially overwriting important server files. This can disrupt normal server operations and cause denial of service. There is no indication of privilege escalation or remote code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoints and limit the application's file system permissions to minimize potential damage from exploitation.