PT-2026-32151 · Astrbot · Astrbot

Yu_Bao · CVE-2026-6119 · Published 2026-04-12 · Updated 2026-04-12

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AstrBot versions up to 4.22.1

Description A server-side request forgery exists in the post data.get function of the API Endpoint component in AstrBot. This manipulation can be performed remotely. The exploit is publicly available.

Recommendations Update AstrBot to a version newer than 4.22.1.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-6119

Affected Products

Astrbot

References · 12

• 🔥 https://github.com/AstrBotDevs/AstrBot/issues/7171 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6119.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-6119 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-6119 · Security Note
• https://github.com/AstrBotDevs/AstrBot · Note
• https://twitter.com/VulmonFeeds/status/2043217413060133165 · Twitter Post
• https://twitter.com/CVEnew/status/2043220239555391799 · Twitter Post
• https://twitter.com/infoflowcloud/status/2043221557980344597 · Twitter Post
• https://vuldb.com/submit/792661 · Note
• https://twitter.com/CVEarity/status/2043339047523975431 · Twitter Post
• https://vuldb.com/vuln/356979 · Note
• https://vuldb.com/vuln/356979/cti · Note