Arbitrary Local File Read Vulnerability in CrewAI by CrewAI Technologies
CVE-2026-2285

7.5HIGH

Key Information:

Vendor

Crewai

Status
Crewai
Vendor
CVE Published:
30 March 2026

What is CVE-2026-2285?

CrewAI's JSON loader tool exposes a significant security weakness due to its lack of path validation. This vulnerability allows unauthorized users to read any file located on the server, potentially leading to data exposure, system compromise, and other serious security issues. Organizations using CrewAI must address this flaw promptly to secure their data and maintain user trust.

Affected Version(s)

CrewAI 1.0

References

https://www.kb.cert.org/vuls/id/221883

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.