{"action":"Upgrade astrbot to 4.23.6 or later.","affected":[{"fixed":"4.23.6","introduced":"0"}],"component":"astrbot","cve_ids":["CVE-2026-8754"],"ecosystem":"PyPI","epss":0.00358,"exploited":false,"fixed_versions":["4.23.6"],"ghsa_id":"GHSA-f63h-wc26-pmvc","id":"tcs_01M5KFEJSP1NDTPBFQDKDD0ZJ7","modified_at":"2026-07-13T16:43:14.859911222Z","published_at":"2026-05-17T15:31:42Z","references":["https://osv.dev/vulnerability/GHSA-f63h-wc26-pmvc","https://nvd.nist.gov/vuln/detail/CVE-2026-8754","https://github.com/AstrBotDevs/AstrBot/commit/aaec41e5054569ceaa1113593a34da7568e2d211","https://gist.github.com/YLChen-007/054415c2b63e58813328bc879a90c504","https://github.com/AstrBotDevs/AstrBot","https://github.com/AstrBotDevs/AstrBot/releases/tag/v4.23.6","https://vuldb.com/submit/811172","https://vuldb.com/vuln/364381","https://vuldb.com/vuln/364381/cti"],"severity":{"label":"medium","score":6.3},"sources":[{"source":"osv","source_id":"GHSA-f63h-wc26-pmvc","url":"https://osv.dev/vulnerability/GHSA-f63h-wc26-pmvc"}],"summary":"AstrBot: File upload vulnerability in the function post_file of the file astrbot/dashboard/routes/chat.py"}