PyPI/astrbot CVE-2025-48957: high 7.5, EPSS 0.74%

AstrBot Has Path Traversal Vulnerability in /api/chat/get_file

Action: Upgrade astrbot to 3.5.13 or later.

pip install astrbot==3.5.13

Affected

Fixed versions

Sources

• osv: GHSA-cq37-g2qp-3c2p
• https://github.com/AstrBotDevs/AstrBot/security/advisories/GHSA-cq37-g2qp-3c2p
• https://nvd.nist.gov/vuln/detail/CVE-2025-48957
• https://github.com/AstrBotDevs/AstrBot/issues/1675
• https://github.com/AstrBotDevs/AstrBot/pull/1676
• https://github.com/AstrBotDevs/AstrBot/commit/cceadf222c46813c7f41115b40d371e7eb91e492
• https://github.com/AstrBotDevs/AstrBot
• https://www.vicarius.io/vsociety/posts/cve-2025-48957-detect-astrbot-dashboard-vulnerability?prevUrl=wizard
• https://www.vicarius.io/vsociety/posts/cve-2025-48957-mitigate-astrbot-dashboard-vulnerability?prevUrl=wizard

CVE-2025-48957 · published 2025-06-04T23:54:35Z · modified 2026-09-10T03:50:25.264985334Z · JSON