Most recent entries from all

EUVD-2026-245616

2026-10-08T21:43:28.308501+00:00

EUVD-2026-245616

fkie_cve-2025-48957

2026-10-08T21:43:28.308540+00:00

AstrBot is a large language model chatbot and development framework. A path traversal vulnerability present in versions 3.4.4 through 3.5.12 may lead to information disclosure, such as API keys for LLM providers, account passwords, and other sensitive data. The vulnerability has been addressed in Pull Request #1676 and is included in version 3.5.13. As a workaround, users can edit the `cmd_config.json` file to disable the dashboard feature as a temporary workaround. However, it is strongly recommended to upgrade to version v3.5.13 or later to fully resolve this issue.

GHSA-cq37-g2qp-3c2p — AstrBot Has Path Traversal Vulnerability in /api/chat/get_file

2026-10-08T21:43:28.308576+00:00

Affected: PyPI: astrbot

### Impact

This vulnerability may lead to:

* Information disclosure, such as API keys for LLM providers, account passwords, and other sensitive data.

### Reproduce

Follow these steps to set up a test environment for reproducing the vulnerability:

1. Install dependencies and clone the repository:

```bash pip install uv git clone https://github.com/AstrBotDevs/AstrBot && cd AstrBot uv run main.py ```

2. Alternatively, deploy the program via pip:

```bash mkdir astrbot && cd astrbot uvx astrbot init uvx astrbot run ```

3. In another terminal, run the following command to exploit the vulnerability:

```bash curl -L http://0.0.0.0:6185/api/chat/get_file?filename=../../../data/cmd_config.json ```

This request will read the `cmd_config.json` config file, leading to the leakage of sensitive data such as LLM API keys, usernames, and password hashes (MD5).

### Patches

The vulnerability has been addressed in [Pull Request #1676](https://github.com/AstrBotDevs/AstrBot/pull/1676) and is included in versions >= v3.5.13. All users are strongly encouraged to upgrade to v3.5.13 or later.

### Workarounds Users can edit the cmd_config.json file to disable the dashboard feature as a temporary workaround. However, it is strongly recommended to upgrade to version v3.5.13 or later as soon as possible to fully resolve this issue.

### References

* [Pull Request #1676](https://github.com/AstrBotDevs/AstrBot/pull/1676) * [Issue #1675](https://github…

PYSEC-2026-1196 — AstrBot Has Path Traversal Vulnerability in /api/chat/get_file

2026-10-08T21:43:28.308628+00:00