Threats tagged 'ghsa-r9hw-78q5-478g'

Crawl4AI versions before 0.8.7 have an arbitrary file write vulnerability in the Docker API server's /screenshot and /pdf endpoints. The vulnerability arises because the output_path parameter does not validate input, allowing attackers to write files to arbitrary locations accessible by the application user. This can lead to overwriting server files and cause denial of service.