Crawl4AI < 0.8.0 - Local File Inclusion
The Crawl4AI Docker API endpoints accepted arbitrary URL schemes without an allow-list. An unauthenticated request with a file:// URL could read local files. Fixed in 0.8.0, which restricts accepted URL schemes.
PoC 已收录Crawl4AI
CVSS—EPSS 2.1%