The vulnerability is a Server‑Side Request Forgery (SSRF) in Crawl4AI version 0.8.7 and earlier, affecting the /crawl, /crawl/stream, /md, and /llm endpoints. The endpoints retrieve arbitrary URLs provided by the attacker without validation, allowing an unauthenticated user to access internal services, service metadata, and other sensitive resources. This flaw can compromise confidentiality, integrity, or availability and falls under CWE‑918.

Vendor: Crawl4AI. Product: Crawl4AI. Versions before 0.8.7 are affected; the CVE does not specify individual patch releases beyond the 0.8.7 threshold.

The CVSS score of 9.2 indicates a high severity issue. EPSS data are not available, so the exact likelihood of exploitation cannot be quantified, but the lack of input validation combined with the ability to use IPv6‑mapped IPv4 addresses to bypass internal-address blocklists suggests that the attack is practical and can be performed without authentication. The vulnerability is not listed in the CISA KEV catalog, indicating no known mass exploitation, yet the exposed endpoints pose a significant risk to exposed environments.