PT-2025-45799 · Pypi · Astrbot

Publicado 2025-11-07 · Atualizado 2025-11-07

OSV

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

AstrBot Project v3.5.22 contains a directory traversal vulnerability. The handler function install plugin upload of the interface '/plugin/install-upload' parses the filename from the request body provided by the user, and directly uses the filename to assign to file path without checking the validity of the filename. The variable file path is then passed as a parameter to the function file.save, so that the file in the request body can be saved to any location in the file system through directory traversal.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

GHSA-XRJ9-MW57-J34V

Produtos afetados

Astrbot

Referências · 4

• https://github.com/AstrBotDevs/AstrBot · Nota
• https://github.com/DYX217/vulnerability-explore/blob/main/2/README.md · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-57698 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-xrj9-mw57-j34v · Aviso do Fabricante