CVE-2025-48957
2 advisories.
PyPI/astrbot CVE-2025-48957: high 7.5
AstrBot Has Path Traversal Vulnerability in /api/chat/get_file
Action: Upgrade astrbot to 3.5.13 or later.
pip install astrbot==3.5.13Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.4.4 | 3.5.13 | - |
Fixed versions
| 3.5.13 |
Sources
- osv: GHSA-cq37-g2qp-3c2p
- https://github.com/AstrBotDevs/AstrBot/security/advisories/GHSA-cq37-g2qp-3c2p
- https://nvd.nist.gov/vuln/detail/CVE-2025-48957
- https://github.com/AstrBotDevs/AstrBot/issues/1675
- https://github.com/AstrBotDevs/AstrBot/pull/1676
- https://github.com/AstrBotDevs/AstrBot/commit/cceadf222c46813c7f41115b40d371e7eb91e492
- https://github.com/AstrBotDevs/AstrBot
- https://www.vicarius.io/vsociety/posts/cve-2025-48957-detect-astrbot-dashboard-vulnerability?prevUrl=wizard
- https://www.vicarius.io/vsociety/posts/cve-2025-48957-mitigate-astrbot-dashboard-vulnerability?prevUrl=wizard
CVE-2025-48957 · published · modified · JSON
PyPI/astrbot CVE-2025-48957: high 7.5
AstrBot Has Path Traversal Vulnerability in /api/chat/get_file
Action: Upgrade astrbot to 3.5.13 or later.
pip install astrbot==3.5.13Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.4.4 | 3.5.13 | - |
Fixed versions
| 3.5.13 |
Sources
- osv: PYSEC-2026-1196
- https://github.com/AstrBotDevs/AstrBot/security/advisories/GHSA-cq37-g2qp-3c2p
- https://nvd.nist.gov/vuln/detail/CVE-2025-48957
- https://github.com/AstrBotDevs/AstrBot/issues/1675
- https://github.com/AstrBotDevs/AstrBot/pull/1676
- https://github.com/AstrBotDevs/AstrBot/commit/cceadf222c46813c7f41115b40d371e7eb91e492
- https://github.com/AstrBotDevs/AstrBot
- https://www.vicarius.io/vsociety/posts/cve-2025-48957-detect-astrbot-dashboard-vulnerability?prevUrl=wizard
- https://www.vicarius.io/vsociety/posts/cve-2025-48957-mitigate-astrbot-dashboard-vulnerability?prevUrl=wizard
- https://pypi.org/project/astrbot
- https://github.com/advisories/GHSA-cq37-g2qp-3c2p
CVE-2025-48957 · published · modified · JSON