External risk intelligence

Firecrawl Arbitrary File Read and SSRF Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-72904

Firecrawl is designed as an API-based service to process and extract data from websites. Because it functions as an externally reachable API endpoint for web data processing, it is commonly deployed as a public-facing service or integrated into internet-connected web applications.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in Firecrawl's data extraction functionality could allow an attacker to read sensitive files from the server or conduct server-side requests, potentially exposing internal data or systems. This issue arises from how the software handles user-supplied data schemas.

Unsafe data handling allows reading server files.
Critical flaw may expose sensitive internal data.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by submitting a specially crafted JSON schema to the extraction API. This schema, when processed, can cause the application to dereference external or local file paths, potentially leading to sensitive information disclosure or server-side request forgery.

Network access required; no authentication needed.
Malicious JSON schema triggers file read.
Leads to sensitive data exposure or SSRF.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an arbitrary file read vulnerability in Firecrawl's extraction functionality could expose file contents from the extract worker filesystem. This may occur when an attacker supplies a malicious JSON schema during extraction, triggering an error that includes file contents in the API's response. Server-side request forgery against internal or external HTTP endpoints is also a potential risk.

System files on the extract worker.
Malicious schema, error messages.
Unauthorized access to sensitive data.

Operational Fix

Recommended remediation, mitigation, and detection steps

Security and platform teams are likely responsible for addressing this vulnerability in Firecrawl, as it affects the extraction functionality of an API-based service. The initial step is to identify all instances of Firecrawl, determine their exposure and criticality, and then engage the accountable owners to plan for remediation.

Application and platform teams own this.
Verify Firecrawl reachability and critical usage.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Firecrawl?

Firecrawl is a specialized tool that converts websites into clean markdown or structured data. Developers typically use it to transform raw web content into a format easily processed by large language models, often running it as an API service to handle automated data extraction tasks.

What is the vulnerability in CVE-2026-72904?

This flaw involves unsafe schema dereferencing. When the software processes user-provided JSON schemas, it inadvertently allows the system to resolve local file paths or external network addresses. This weakness falls under categories like command and code injection, where the application improperly trusts inputs, leading to sensitive file exposure or unauthorized server-side requests.

How can an attacker trigger this vulnerability?

An attacker triggers this by submitting a malicious JSON schema to the extraction API. This schema must contain specific references designed to fail during processing. Normal or valid schema usage that does not attempt to reference external or local files will not trigger this bug; the vulnerability specifically relies on exploiting the software's error-handling mechanism to leak information.

Is my instance of Firecrawl at risk?

According to Halo Surface Signal, Firecrawl is commonly deployed as a public-facing API service, making it highly likely to be internet-reachable. If your instance is exposed to the internet, it is at higher risk because the vulnerability does not require authentication to exploit. Internal-only instances still face risk if they are accessible to untrusted users within your network.

How do I respond to this CVE?

The most effective first step is to update your Firecrawl deployment to version 2.11.32 or later, which contains the fix. You should also audit your current environment to locate all running instances of the software and confirm their version numbers. Prioritize updating any publicly accessible services, as these are the primary targets for exploitation.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.