GHSA-2jq4-q6vv-4cp3

Affected versions of the Crawl4AI package are vulnerable to Path Traversal due to improper handling of filenames derived from attacker-influenced input. The `AsyncHTTPCrawlerStrategy` and `AsyncPlaywrightCrawlerStrategy` in `crawl4ai/async_crawler_strategy.py` fail to sanitize filenames extracted from the `Content-Disposition` header and `suggested_filename`, respectively, allowing traversal outside the intended downloads directory. An attacker can exploit this by crafting filenames with absolute paths or `../` sequences, enabling arbitrary file writes with controlled content, potentially leading to Remote Code Execution by overwriting critical system files or scripts.