Path Traversal Vulnerability in gpt-crawler via outputFileName Parameter

CVE-2026-82286 is an arbitrary file write vulnerability affecting gpt-crawler versions up to and including 1.5.1. The flaw exists within the POST /crawl endpoint, which fails to adequately sanitize the 'outputFileName' parameter. An unauthenticated attacker can exploit this lack of validation by supplying crafted input containing path traversal sequences (e.g., ../) or absolute filesystem paths.

By manipulating this parameter, an attacker can influence where the crawler writes its output, enabling the overwriting of critical system files or configuration files with content fetched from attacker-controlled URLs. If successfully exploited, this can lead to remote code execution or system compromise depending on the overwritten target. Defenders should prioritize patching gpt-crawler to a fixed version or restricting access to the /crawl endpoint to authorized users only.

Impact

Successful exploitation of this vulnerability allows an unauthenticated attacker to achieve arbitrary file writes on the host system. This can lead to system-level configuration changes, the overwriting of binaries, or the placement of malicious web shells. The scope of impact includes any environment where gpt-crawler is deployed with external-facing access.

Recommendation

• Upgrade gpt-crawler to a version beyond 1.5.1 immediately.
• Implement access control mechanisms to prevent unauthenticated access to the /crawl API endpoint.
• Audit existing deployments for logs showing unexpected POST requests to /crawl where the 'outputFileName' parameter contains directory traversal characters.