Approved changes feed: RSS · Atom
cpe:2.3:a:astrbotdevs:astrbot:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Astrbotdevs (aae0c57e-168b-54c0-a410-6913432f42a8) |
|---|---|
| Product | Astrbot (318831a1-b962-5ff1-8b1a-be14c96ce074) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-48957 |
vulnerable | 2026-06-08 07:29:12.315145 |
AstrBot Has Path Traversal Vulnerability in /api/chat/get_file
HIGH (7.5)
AstrBot is a large language model chatbot and development framework. A path traversal vulnerability present in versions 3.4.4 through 3.5.12 may lead to information disclosure, such as API keys for LLM providers, account passwords, and other sensitive data. The vulnerability has been addressed in Pull Request #1676 and is included in version 3.5.13. As a workaround, users can edit the `cmd_config.json` file to disable the dashboard feature as a temporary workaround. However, it is strongly recommended to upgrade to version v3.5.13 or later to fully resolve this issue.
Published: 2025-06-02T11:16:14.370Z
Updated: 2025-06-23T18:03:57.703Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.