Information disclosure in scrapy - #VU162978
Published: November 9, 2026
Vulnerability identifier: #VU162978
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker controlling crawled content to cause local file reads or steal configured FTP credentials.
The vulnerability exists due to insufficient URL scheme restrictions in Scrapy's LinkExtractor and SitemapSpider when processing crawled content. An unauthenticated remote attacker can inject file:// or ftp:// URLs to pass local files to spider callbacks or send FTP credentials to an attacker-controlled server, provided allowed_domains is unset for file access or permits the FTP host.
Affected software
scrapy
Remediation
Install security update from vendor's website.
scrapy - update to 2.20.0