https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 18:46:33 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-260566 EUVD-2026-260566 https://cve.radiocsirt.org/vuln/euvd-2026-260566 https://cve.radiocsirt.org/vuln/fkie_cve-2025-57698 <p>AstrBot Project v3.5.22 contains a directory traversal vulnerability. The handler function install_plugin_upload of the interface &#39;/plugin/install-upload&#39; parses the filename from the request body provided by the user, and directly uses the filename to assign to file_path without checking the validity of the filename. The variable file_path is then passed as a parameter to the function `file.save`, so that the file in the request body can be saved to any location in the file system through directory traversal.</p> <p>AstrBot Project v3.5.22 contains a directory traversal vulnerability. The handler function install_plugin_upload of the interface &#39;/plugin/install-upload&#39; parses the filename from the request body provided by the user, and directly uses the filename to assign to file_path without checking the validity of the filename. The variable file_path is then passed as a parameter to the function `file.save`, so that the file in the request body can be saved to any location in the file system through directory traversal.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-57698 https://cve.radiocsirt.org/vuln/ghsa-xrj9-mw57-j34v <p><strong>Affected:</strong> PyPI: AstrBot</p> <p>AstrBot Project v3.5.22 contains a directory traversal vulnerability. The handler function install_plugin_upload of the interface &#39;/plugin/install-upload&#39; parses the filename from the request body provided by the user, and directly uses the filename to assign to file_path without checking the validity of the filename. The variable file_path is then passed as a parameter to the function `file.save`, so that the file in the request body can be saved to any location in the file system through directory traversal.</p> <p><strong>Affected:</strong> PyPI: AstrBot</p> <p>AstrBot Project v3.5.22 contains a directory traversal vulnerability. The handler function install_plugin_upload of the interface &#39;/plugin/install-upload&#39; parses the filename from the request body provided by the user, and directly uses the filename to assign to file_path without checking the validity of the filename. The variable file_path is then passed as a parameter to the function `file.save`, so that the file in the request body can be saved to any location in the file system through directory traversal.</p> https://cve.radiocsirt.org/vuln/ghsa-xrj9-mw57-j34v https://cve.radiocsirt.org/vuln/pysec-2026-1198 <p><strong>Affected:</strong> PyPI: astrbot</p> <p>AstrBot Project v3.5.22 contains a directory traversal vulnerability. The handler function install_plugin_upload of the interface &#39;/plugin/install-upload&#39; parses the filename from the request body provided by the user, and directly uses the filename to assign to file_path without checking the validity of the filename. The variable file_path is then passed as a parameter to the function `file.save`, so that the file in the request body can be saved to any location in the file system through directory traversal.</p> <p><strong>Affected:</strong> PyPI: astrbot</p> <p>AstrBot Project v3.5.22 contains a directory traversal vulnerability. The handler function install_plugin_upload of the interface &#39;/plugin/install-upload&#39; parses the filename from the request body provided by the user, and directly uses the filename to assign to file_path without checking the validity of the filename. The variable file_path is then passed as a parameter to the function `file.save`, so that the file in the request body can be saved to any location in the file system through directory traversal.</p> https://cve.radiocsirt.org/vuln/pysec-2026-1198