Arbitrary File Read Vulnerability in Firecrawl Web Extraction Tool

CVE-2026-72904

What is CVE-2026-72904?

Firecrawl, a tool designed to convert entire websites into LLM-ready markdown or structured data, has a vulnerability in its extraction functionality. Prior to version 2.11.32, the extraction process suffers from an arbitrary file read issue caused by unsafe schema dereferencing of user-supplied JSON schemas. The implementation improperly utilizes the json-schema-ref-parser dependency with default resolver settings, which enables both external and local file references during schema processing. This flaw allows an authenticated attacker to craft a malicious schema, which when processed, can lead to exposure of sensitive file contents from the extract worker filesystem. Persisted error messages returned via the extraction API may inadvertently leak these contents, thereby granting unauthorized access to internal or external HTTP endpoints. The issue has been addressed in version 2.11.32.

References