PT-2026-32149 · Astrbot · Astrbot

Yu_Bao · Published 2026-04-12 · Updated 2026-04-12 · CVE-2026-6117

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AstrBot versions up to 4.22.1

Description A security issue exists in AstrBotDevs AstrBot up to version 4.22.1. The install plugin upload function within the astrbot/dashboard/routes/plugin.py file is susceptible to a sandbox issue due to manipulation of the File argument. This issue can be exploited remotely. The exploit has been publicly disclosed.

Recommendations Versions prior to 4.22.1 should be used.

Exploit

Fix

RCE

Weakness Enumeration

CWE-265

CWE-264

Related Identifiers

CVE-2026-6117

Affected Products

Astrbot

References · 10

• 🔥 https://github.com/AstrBotDevs/AstrBot/issues/7168 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-6117 · Security Note
• https://vuldb.com/vuln/356977/cti · Note
• https://twitter.com/CVEnew/status/2043220241581236503 · Twitter Post
• https://twitter.com/infoflowcloud/status/2043221574581399815 · Twitter Post
• https://vuldb.com/vuln/356977 · Note
• https://vuldb.com/submit/792653 · Note
• https://github.com/AstrBotDevs/AstrBot · Note
• https://twitter.com/VulmonFeeds/status/2043204613428396158 · Twitter Post
• https://twitter.com/CVEarity/status/2043330713265791061 · Twitter Post