PYSEC-2026-1196 AstrBot Has Path Traversal Vulnerability in /api/chat/get_file

Impact This vulnerability may lead to: Information disclosure, such as API keys for LLM providers, account passwords, and other sensitive data. Reproduce Follow these steps to set up a test environment for reproducing the vulnerability: 1. Install dependencies and clone the repository: bash pip...

Relative Path Traversal

Overview AstrBot is a 易上手的多平台 LLM 聊天机器人及开发框架 Affected versions of this package are vulnerable to Relative Path Traversal through the /api/chat/getfile endpoint. An attacker can access sensitive information such as API keys and account passwords by manipulating the file path input to traverse to...

PT-2018-2000 · Kubernetes · Minikube

Name of the Vulnerable Software and Affected Versions: minikube versions 0.3.0 through 0.29.0 Description: The issue is related to privilege management errors in the minikube command-line utility. It allows a remote attacker to execute arbitrary code. In certain VM environments where the IP is ea...