Crawl4AI before 0.8.7 allows an attacker to write any file to the host filesystem through the /screenshot and /pdf endpoints of its Docker API server. The output_path parameter accepts absolute or path-traversal values without validation, enabling overwriting of arbitrary files owned by the container's user, which can result in denial of service by corrupting or deleting critical configuration or binary files.

The affected product is Crawl4AI version 0.8.6 and earlier. Any installation that runs the Docker API server and exposes the /screenshot or /pdf endpoints to an untrusted network is vulnerable. The vulnerability exists regardless of whether the container is run with elevated privileges; any writable host directory mapped to the container can be modified by an attacker.

The CVSS score of 8.8 indicates a high severity, and the EPSS score of less than 1% signals a very low likelihood of exploitation in the wild. The flaw is not listed in CISA KEV. The likely attack vector is remote API access; exploitation requires no additional privileges beyond those granted to the application’s user on the host. If exploited, an attacker could overwrite arbitrary files and cause downtime or other compromise.