{"cve":"CVE-2025-48957","nvd":{"published":"2025-06-02T12:15:25.680","modified":"2026-06-17T09:30:34.060","status":"Analyzed","description":"AstrBot is a large language model chatbot and development framework. A path traversal vulnerability present in versions 3.4.4 through 3.5.12 may lead to information disclosure, such as API keys for LLM providers, account passwords, and other sensitive data. The vulnerability has been addressed in Pull Request #1676 and is included in version 3.5.13. As a workaround, users can edit the `cmd_config.json` file to disable the dashboard feature as a temporary workaround. However, it is strongly recommended to upgrade to version v3.5.13 or later to fully resolve this issue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5},"cwes":["CWE-22","CWE-23"],"references":["https://github.com/AstrBotDevs/AstrBot/commit/cceadf222c46813c7f41115b40d371e7eb91e492","https://github.com/AstrBotDevs/AstrBot/issues/1675","https://github.com/AstrBotDevs/AstrBot/pull/1676","https://github.com/AstrBotDevs/AstrBot/security/advisories/GHSA-cq37-g2qp-3c2p","https://www.vicarius.io/vsociety/posts/cve-2025-48957-detect-astrbot-dashboard-vulnerability?prevUrl=wizard"],"products":["astrbot:astrbot"],"source":"nvd","synced_at":"2026-10-19T22:02:23.998251710+00:00"},"epss":{"cve":"CVE-2025-48957","score":0.00771,"percentile":0.55687,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-cq37-g2qp-3c2p","url":"https://osv.dev/vulnerability/GHSA-cq37-g2qp-3c2p","summary":"AstrBot Has Path Traversal Vulnerability in /api/chat/get_file","modified":"2026-09-10T03:50:25.264985334Z","packages":[{"ecosystem":"PyPI","name":"astrbot","purl":"pkg:pypi/astrbot","ranges":[">=3.4.4 <3.5.13"],"fixed":["3.5.13"]}]},{"id":"PYSEC-2026-1196","url":"https://osv.dev/vulnerability/PYSEC-2026-1196","summary":"AstrBot Has Path Traversal Vulnerability in /api/chat/get_file","modified":"2026-07-07T17:46:22.631166274Z","packages":[{"ecosystem":"PyPI","name":"astrbot","purl":"pkg:pypi/astrbot","ranges":[">=3.4.4 <3.5.13"],"fixed":["3.5.13"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}