(CVE-2025-48957) AstrBot路径遍历漏洞导致敏感信息泄露

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-48957
• https://github.com/AstrBotDevs/AstrBot/security/advisories/GHSA-cq37-g2qp-3c2p
• https://adg.csdn.net/6952287f5b9f5f31781b26e1.html
• https://www.cvedetails.com/cve/CVE-2025-48957/
• https://www.sentinelone.com/vulnerability-database/cve-2025-48957/
• https://www.ameeba.com/blog/cve-2025-48957-path-traversal-vulnerability-in-astrbot-llm-chatbot/
• https://github.com/AstrBotDevs/AstrBot/issues/1675
• https://advisories.gitlab.com/pypi/astrbot/CVE-2025-48957/

Related Vulnerabilities

• PoCCVE-2026-6118: AstrBot <= 4.22.1 - Command Injection
• PoCastrbot-default-login: AstrBot - Default Login
• AstrBot 存在上传插件RCE漏洞(CVE-2025-55449)
• AstrBot 存在未授权访问漏洞
• AstrBot /api/plugin/install-upload 命令执行漏洞（CVE-2025-55449）
• AstrBot 身份验证缺陷 可导致远程代码执行
• AstrBot /api/auth/login 默认口令漏洞
• AstrBot /api/chat/get_file 目录遍历漏洞 （CVE-2025-48957）
• AstrBot get_file接口存在任意文件读取(CVE-2025-48957)