CVE-2025-57697

AstrBot Project v3.5.22 is vulnerable to an arbitrary file read (Directory Traversal) vulnerability within the _encode_image_bs64 function located in entities.py. The root cause is the lack of validation on the image path provided by the user in the request body; the function opens the specified ...