Crawl4AI deployments running a version earlier than 0.8.0 contain a flaw in the Docker API where the /execute_js, /screenshot, /pdf, and /html endpoints accept file:// URLs. An unauthenticated attacker can supply such a URL and the service will read the referenced file from the host filesystem, providing direct access to the contents of that file.

All installations of Crawl4AI from the vendor unclecode that use Docker and run a version older than 0.8.0 are affected. The vulnerability is in the Docker API implementation of the Crawl4AI package and can be exploited in any environment that exposes the API endpoints directly to the network.

The flaw carries a CVSS score of 9.2, indicating a high‑severity vulnerability. The EPSS score is below 1% and the issue is not listed in the CISA KEV catalog, but the ease of exploitation—any remote host can send a crafted HTTP request without authentication—is significant. An attacker who controls the file:// target can read sensitive files such as /etc/passwd, /etc/shadow, configuration files, or environment variables, potentially exposing credentials, API keys, and system details.