Path Traversal

astrbot is vulnerable to a Path Traversal. The vulnerability is due to improper validation or sanitization of file path inputs, allowing attackers to access files outside the intended directories...

CVE-2025-48957 AstrBot Has Path Traversal Vulnerability in /api/chat/get_file

AstrBot is a large language model chatbot and development framework. A path traversal vulnerability present in versions 3.4.4 through 3.5.12 may lead to information disclosure, such as API keys for LLM providers, account passwords, and other sensitive data. The vulnerability has been addressed in...