PT-2026-32149 · Astrbotdevs · Astrbot

Yu_Bao · Published 2026-04-12 · Updated 2026-04-12 · CVE-2026-6117

Mitre

CVSS v3.1

6.3

Medium

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

A vulnerability was found in AstrBotDevs AstrBot up to 4.22.1. This issue affects the function install plugin upload of the file astrbot/dashboard/routes/plugin.py of the component install-upload Endpoint. The manipulation of the argument File results in sandbox issue. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Exploit

Fix

RCE

Weakness Enumeration

CWE-264

CWE-265

Related Identifiers

CVE-2026-6117

Affected Products

Astrbot

References · 7

• 🔥 https://github.com/AstrBotDevs/AstrBot/issues/7168 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-6117 · Security Note
• https://vuldb.com/vuln/356977/cti · Note
• https://twitter.com/VulmonFeeds/status/2043204613428396158 · Twitter Post
• https://vuldb.com/vuln/356977 · Note
• https://github.com/AstrBotDevs/AstrBot · Note
• https://vuldb.com/submit/792653 · Note