Crawl4AI versions prior to 0.8.7 allow attackers to write to arbitrary files through the Docker API server’s /screenshot and /pdf endpoints. The vulnerable output_path parameter accepts any filesystem path, including those containing absolute or relative traversal sequences. This weakness, classified as CWE-22 "Path Traversal", permits overwriting existing server files, which can lead to denial of service or further compromise if the attacker writes malicious payloads.

The flaw affects the Crawl4AI product Docker API server that hosts the /screenshot or /pdf endpoints and uses a version older than 0.8.7. Users running an earlier release are susceptible to the file‑write vulnerability.

The CVSS score of 8.8 indicates critical impact. The EPSS score of <1% shows a very low probability of exploitation, and the vulnerability can be exploited if an attacker can access the API. The lack of input validation allows. The likely attack vector is remote API exploitation, and the consequence is loss of data integrity and availability on the host machine.