Description
AstrBot是一个大型语言模型聊天机器人和开发框架。版本3.4.4至3.5.12中存在路径遍历漏洞，可能导致信息泄露，如LLM提供商的API密钥、账户密码和其他敏感数据。
AstrBot /api/chat/get_file 目录遍历漏洞 （CVE-2025-48957）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-48957
https://github.com/AstrBotDevs/AstrBot/security/advisories/GHSA-cq37-g2qp-3c2p
https://adg.csdn.net/6952287f5b9f5f31781b26e1.html
https://idocdown.com/app/articles/blogs/detail/16880
https://nosec.org/m/share/5889.html
https://www.vicarius.io/vsociety/posts/cve-2025-48957-detect-astrbot-dashboard-vulnerability
https://www.sentinelone.com/vulnerability-database/cve-2025-48957/
https://advisories.gitlab.com/pypi/astrbot/CVE-2025-48957/