EUVD-2025-16634
GHSA-cq37-g2qp-3c2p
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
5DescriptionGitHub Advisory
AstrBot is a large language model chatbot and development framework. A path traversal vulnerability present in versions 3.4.4 through 3.5.12 may lead to information disclosure, such as API keys for LLM providers, account passwords, and other sensitive data. The vulnerability has been addressed in Pull Request #1676 and is included in version 3.5.13. As a workaround, users can edit the cmd_config.json file to disable the dashboard feature as a temporary workaround. However, it is strongly recommended to upgrade to version v3.5.13 or later to fully resolve this issue.
AnalysisAI
AstrBot versions 3.4.4 through 3.5.12 contain a path traversal vulnerability (CWE-23) in the dashboard feature that allows unauthenticated remote attackers to disclose sensitive information including LLM provider API keys, account passwords, and other confidential data. The vulnerability has a CVSS score of 7.5 (High) with high confidentiality impact and no authentication requirements. Patch is available in version 3.5.13 and later via Pull Request #1676.
Technical ContextAI
The vulnerability exists in AstrBot's web dashboard component and stems from improper input validation on file path parameters (CWE-23: Relative Path Traversal). The dashboard feature fails to properly sanitize or restrict user-supplied path inputs, allowing attackers to traverse the filesystem using relative path sequences (e.g., '../../../') to access files outside the intended directory. AstrBot stores sensitive configuration data including API credentials in configuration files (cmd_config.json and related configuration stores) within the application directory. The path traversal flaw permits direct access to these files through HTTP requests without authentication. The vulnerability affects the LLM chatbot framework across multiple minor versions, impacting both the core framework and any deployments using the vulnerable dashboard feature.
RemediationAI
Upgrade to AstrBot version 3.5.13 or later; priority: IMMEDIATE; details: The vulnerability is fully resolved in version 3.5.13. Apply patch via Pull Request #1676. Temporary Workaround: Disable the dashboard feature; priority: HIGH (if upgrade is delayed); steps: ['Edit the cmd_config.json configuration file', 'Set the dashboard feature to disabled/false', 'Restart the AstrBot service', 'Verify dashboard is no longer accessible']; limitations: This workaround removes dashboard functionality but does not patch the underlying vulnerability. Only suitable as a temporary measure pending upgrade. Network Mitigation: Restrict dashboard access; priority: MEDIUM (supplementary control); steps: ['Implement network-level access controls to restrict dashboard ports', 'Use firewall rules to limit access to trusted internal networks only', 'Consider placing AstrBot behind a WAF with path traversal detection', 'Implement IP whitelisting if applicable'] Detection & Response: Monitor for exploitation attempts; priority: MEDIUM; steps: ['Review access logs for suspicious path traversal patterns (../ sequences)', 'Monitor file access logs for unexpected reads of cmd_config.json and sensitive files', 'Rotate all stored API keys and passwords immediately if breach suspected', 'Audit audit logs for unauthorized configuration access']
Hard-coded credentials in AstrBot Dashboard (versions ≤4.16.0) enable remote unauthenticated attackers to bypass authent
Command injection in AstrBot's MCP endpoint handler (add_mcp_server function) allows authenticated remote attackers to e
Authentication bypass by spoofing in AstrBot up to version 4.25.5 allows low-privileged remote attackers to impersonate
Authorization bypass in AstrBot's dashboard API allows any authenticated low-privileged user to enumerate and read chat
Server-side request forgery in AstrBot's dashboard MCP Test Endpoint allows low-privileged authenticated users to coerce
Server-side request forgery in AstrBotDevs AstrBot up to version 4.25.2 allows authenticated low-privilege users to make
Path traversal in AstrBot 4.23.6 allows authenticated remote attackers to manipulate the Name parameter of the /api/skil
Injection in AstrBot 4.23.6 allows authenticated remote attackers to manipulate input through the `_sanitize_prompt_desc
AstrBot versions up to 4.22.1 allow authenticated remote attackers to bypass sandbox restrictions via malicious file upl
Authorization bypass in AstrBotDevs AstrBot 4.24.2 enables remote low-privilege authenticated attackers to manipulate th
Incorrect authorization in AstrBot 4.23.6 allows remote low-privileged attackers to bypass filesystem path restrictions
Path traversal in AstrBot dashboard file upload allows authenticated remote attackers to write files outside intended di
Same weakness CWE-23 – Relative Path Traversal
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today