PT-2025-23500 · Astrbot · Astrbot

Raven95676 + 1 · CVE-2025-48957 · Published 2025-06-02 · Updated 2026-07-07

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions AstrBot versions 3.4.4 through 3.5.12

Description AstrBot is a large language model chatbot and development framework. A path traversal vulnerability may lead to information disclosure, such as API keys for LLM providers, account passwords, and other sensitive data. The vulnerability has been addressed in Pull Request #1676 and is included in version 3.5.13.

Recommendations For AstrBot versions 3.4.4 through 3.5.12, as a temporary workaround, users can edit the cmd config.json file to disable the dashboard feature. However, it is strongly recommended to upgrade to version 3.5.13 or later to fully resolve this issue.

Exploit

Fix

Relative Path Traversal

Path traversal

Weakness Enumeration

CWE-23

CWE-22

Related Identifiers

CVE-2025-48957

GHSA-CQ37-G2QP-3C2P

PYSEC-2026-1196

Affected Products

Astrbot

References · 23

• 🔥 https://github.com/AstrBotDevs/AstrBot/issues/1675 · Exploit
• 🔥 https://github.com/AstrBotDevs/AstrBot/security/advisories/GHSA-cq37-g2qp-3c2p · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48957.json · Exploit
• 🔥 https://vicarius.io/vsociety/posts/cve-2025-48957-detect-astrbot-dashboard-vulnerability?prevUrl=wizard · Exploit
• https://github.com/AstrBotDevs/AstrBot/pull/1676 · Patch
• https://github.com/AstrBotDevs/AstrBot/commit/cceadf222c46813c7f41115b40d371e7eb91e492 · Patch
• https://osv.dev/vulnerability/PYSEC-2026-1196 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48957 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48957 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cq37-g2qp-3c2p · Vendor Advisory
• https://github.com/AstrBotDevs/AstrBot · Note
• https://twitter.com/CVEnew/status/1929500867289591811 · Twitter Post
• https://twitter.com/dailycve/status/1937946108619055497 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1929535173428641993 · Twitter Post
• https://github.com/advisories/GHSA-cq37-g2qp-3c2p · Note