An unauthenticated arbitrary file write vulnerability in BuilderIO gpt-crawler allows remote attackers to overwrite critical system files.

This is a path traversal vulnerability (CWE-22) occurring in the POST /crawl endpoint. The application fails to validate the outputFileName parameter, which permits an unauthenticated attacker to use directory traversal sequences to write files to arbitrary locations on the server.

Successful exploitation allows an attacker to overwrite arbitrary files on the system, which can lead to remote code execution, configuration tampering, or denial of service. Given the CVSS score of 8.6, this is a high-severity vulnerability that poses a significant risk to the integrity and availability of the host environment.

Immediate Action: Update gpt-crawler to the latest version where input validation for file paths is enforced. If an update is not available, disable the crawler service until a patch can be applied.

Proactive Monitoring: Monitor server file system activity logs for unauthorized file creation or modification events in sensitive directories. Inspect web server access logs for requests to the /crawl endpoint containing traversal patterns such as "../".

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block requests containing directory traversal sequences like "../" or absolute path references in the input parameters.

Public Exploit Available: Yes, a public proof-of-concept exists via a GitHub repository.

This vulnerability presents a severe risk due to the potential for complete system compromise via arbitrary file writes. IT administrators should treat this as a high-priority item and ensure that the gpt-crawler software is updated or isolated from public networks immediately to prevent potential exploitation.