By manipulating this parameter, an attacker can influence where the crawler writes its output, enabling the overwriting of critical system files or configuration files with content fetched from attacker-controlled URLs. If successfully exploited, this can lead to remote code execution or system compromise depending on the overwritten target. Defenders should prioritize patching gpt-crawler to a fixed version or restricting access to the /crawl endpoint to authorized users only.

Impact

Successful exploitation of this vulnerability allows an unauthenticated attacker to achieve arbitrary file writes on the host system. This can lead to system-level configuration changes, the overwriting of binaries, or the placement of malicious web shells. The scope of impact includes any environment where gpt-crawler is deployed with external-facing access.

Recommendation

• Upgrade gpt-crawler to a version beyond 1.5.1 immediately.
• Implement access control mechanisms to prevent unauthenticated access to the /crawl API endpoint.
• Audit existing deployments for logs showing unexpected POST requests to /crawl where the 'outputFileName' parameter contains directory traversal characters.