Riskcovery

CVE-2026-8754

AstrBotDevs AstrBot File Upload chat.py post_file path traversal

State
Published
Severity
5.3 Medium
Published
May 17, 2026
Updated
May 18, 2026
Reserved
May 16, 2026

Read the record on cve.org

Description

A vulnerability was detected in AstrBotDevs AstrBot up to 4.23.5. Impacted is the function post_file of the file astrbot/dashboard/routes/chat.py of the component File Upload Handler. The manipulation of the argument filename results in path traversal. It is possible to launch the attack remotely. The exploit is now public and may be used. Upgrading to version 4.23.6 is recommended to address this issue. The patch is identified as aaec41e5054569ceaa1113593a34da7568e2d211. You should upgrade the affected component.

Scores

CVSSScoreVectorSource
4.05.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:PVulDB
3.16.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:CVulDB
3.06.3 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:CVulDB
2.06.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:CVulDB

Weaknesses

Affected Products

ProductVersions
AstrBotAstrBotDevs
  • 4.23.0Affected
  • 4.23.1Affected
  • 4.23.2Affected
  • 4.23.3Affected
  • 4.23.4Affected
  • 4.23.5Affected
  • 4.23.6Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.