Crawl4AI, an LLM‑friendly web crawler, allows an attacker to control the filename used for stored downloads. The component that writes files concatenated the attacker‑supplied filename—derived from HTTP Content‑Disposition or browser suggestion—directly with the downloads directory, without checking for absolute paths or traversal sequences. This flaw is a classic path traversal (CWE‑22) and unintended absolute path write (CWE‑59). Because an attacker can supply arbitrary file contents, the vulnerability can lead to remote code execution.

The affected product is the open‑source Crawl4AI crawler by unclecode. Any installation of the tool prior to version 0.9.0 is vulnerable. Versions 0.9.0 and later incorporate input validation that restricts filenames to the downloads directory, eliminating the possibility of writing outside the intended folder.

The flaw is rated CVSS 9.6, indicating critical severity. With an EPSS of less than 1 %, large‑scale exploitation may be unlikely, but the lack of confinement makes the attack straightforward: an attacker can trigger the crawler to download a file whose suggested filename contains a path traversal or absolute path. Based on the description, it is inferred that the attacker need only control the HTTP response or browser download suggestion to supply the malicious filename. The vulnerability is not listed in the CISA KEV catalog, yet its potential for remote code execution warrants immediate attention.