PT-2025-45473 · Unknown · Astrbot Project

Published 2025-11-07 · Updated 2025-12-05 · CVE-2025-57697

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions AstrBot Project version 3.5.22

Description The software contains an arbitrary file read issue in the encode image bs64 function. This function, defined in entities.py, opens an image specified by a user-controlled request body and returns its content as a base64-encoded string without validating the image path. This allows attackers to construct malicious URLs to read any specified file, potentially leading to sensitive data disclosure. The vulnerable function is encode image bs64.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the encode image bs64 function until a patch is available.

Exploit

Fix

Out of bounds Read

Path traversal

Weakness Enumeration

CWE-125

CWE-22

Related Identifiers

CVE-2025-57697

GHSA-VM2F-46XC-5JC3

Affected Products

Astrbot Project

References · 13

• 🔥 https://github.com/DYX217/vulnerability-explore/blob/main/1/README.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-57697 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vm2f-46xc-5jc3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-57697 · Security Note
• https://github.com/AstrBotDevs/AstrBot · Note
• https://reddit.com/r/VulnMatter/comments/1otcofi/resumen_diario_de_vulnerabilidades_10112025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1ouaay3/resumen_diario_de_vulnerabilidades_11112025 · Reddit Post
• https://twitter.com/CVEnew/status/1986861774180597889 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1ov498g/resumen_diario_de_vulnerabilidades_12112025 · Reddit Post
• https://twitter.com/dailycve/status/1997077331651776520 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1986964377723978115 · Twitter Post
• https://t.me/CVEtracker/36783 · Telegram Post
• https://t.me/cveNotify/144941 · Telegram Post