{"action":"Upgrade astrbot to 4.23.6 or later.","affected":[{"fixed":"4.23.6","introduced":"0"}],"component":"astrbot","cve_ids":["CVE-2026-8754"],"ecosystem":"PyPI","epss":0.00358,"exploited":false,"fixed_versions":["4.23.6"],"ghsa_id":"GHSA-f63h-wc26-pmvc","id":"tcs_01M5KGZ4A1HY7E6WDGVBRMJ5XH","modified_at":"2026-07-13T16:31:31.343199026Z","published_at":"2026-07-13T15:19:08.701732Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2380","https://nvd.nist.gov/vuln/detail/CVE-2026-8754","https://github.com/AstrBotDevs/AstrBot/commit/aaec41e5054569ceaa1113593a34da7568e2d211","https://gist.github.com/YLChen-007/054415c2b63e58813328bc879a90c504","https://github.com/AstrBotDevs/AstrBot","https://github.com/AstrBotDevs/AstrBot/releases/tag/v4.23.6","https://vuldb.com/submit/811172","https://vuldb.com/vuln/364381","https://vuldb.com/vuln/364381/cti","https://pypi.org/project/astrbot","https://github.com/advisories/GHSA-f63h-wc26-pmvc"],"severity":{"label":"medium","score":6.3},"sources":[{"source":"osv","source_id":"PYSEC-2026-2380","url":"https://osv.dev/vulnerability/PYSEC-2026-2380"}],"summary":"AstrBot: File upload vulnerability in the function post_file of the file astrbot/dashboard/routes/chat.py"}