GitHub Advisoryadvisory · PyPI

GHSA-xrj9-mw57-j34v AstrBot contains a directory traversal vulnerability

HIGH Published 2025-11-07 Modified 2025-11-07 Official page ↗
Aliases
CVE-2025-57698
Ecosystem
PyPI
Packages
AstrBot
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-22
Reviewed
2025-11-07

Affected packages

• PyPI AstrBot: <= 3.5.22 (no fix yet)

Description

AstrBot Project v3.5.22 contains a directory traversal vulnerability. The handler function install_plugin_upload of the interface '/plugin/install-upload' parses the filename from the request body provided by the user, and directly uses the filename to assign to file_path without checking the validity of the filename. The variable file_path is then passed as a parameter to the function `file.save`, so that the file in the request body can be saved to any location in the file system through directory traversal.

Related

Alias · CVE (1)

  • CVE-2025-57698 AstrBot Project v3.5.22 contains a directory traversal vulnerability. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References