GHSA-7cx2-g3h9-382p

Affected versions of the Crawl4AI package are vulnerable to Arbitrary File Write due to improper validation of symlink paths. The `POST /screenshot` and `POST /pdf` endpoints accept an `output_path` parameter that was only string-validated against `ALLOWED_OUTPUT_DIR`, allowing symlink traversal to write files outside the intended directory. An attacker can exploit this by crafting a symlink within the allowed directory to a sensitive location, potentially achieving code execution if the runtime user has write permissions to executable directories, as the API is unauthenticated by default.