Kurz gesagt
- CVE-2025-57698 ist eine Schwachstelle (HOCH (CVSS 7.5)) in astrbot, astrbot (astrbot).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.83%, höher als bei 57.8% aller Schwachstellen.
- Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.
| Package | Affected versions | Patched versions |
|---|
| astrbot PyPI | ≤ 3.5.22
| No fix yet |
| astrbot | = 3.5.22
| No fix yet |
Description
AstrBot Project v3.5.22 contains a directory traversal vulnerability. The handler function install_plugin_upload of the interface '/plugin/install-upload' parses the filename from the request body provided by the user, and directly uses the filename to assign to file_path without checking the validity of the filename. The variable file_path is then passed as a parameter to the function file.save, so that the file in the request body can be saved to any location in the file system through directory traversal.
NVD description
AstrBot Project v3.5.22 contains a directory traversal vulnerability. The handler function install_plugin_upload of the interface '/plugin/install-upload' parses the filename from the request body provided by the user, and directly uses the filename to assign to file_path without checking the validity of the filename. The variable file_path is then passed as a parameter to the function `file.save`, so that the file in the request body can be saved to any location in the file system through directory traversal.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free