EUVD-2026-33534
GHSA-pvgx-43cj-688x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in AstrBotDevs AstrBot 4.23.6. This vulnerability affects unknown code of the file /api/skills/delete of the component API Endpoint. Performing a manipulation of the argument Name results in path traversal. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Path traversal in AstrBot 4.23.6 allows authenticated remote attackers to manipulate the Name parameter of the /api/skills/delete API endpoint to escape the intended directory boundary, enabling unauthorized deletion or corruption of arbitrary files on the host system. The CVSS vector (C:N/I:L/A:L) confirms no confidentiality exposure but meaningful integrity and availability impact. A public proof-of-concept exploit is available on GitHub; the vendor did not respond to responsible disclosure, and no patch has been released at time of analysis.
Technical ContextAI
AstrBot is a chatbot and AI assistant management framework developed by AstrBotDevs. The vulnerable component is the /api/skills/delete API endpoint, which accepts a user-controlled Name parameter used in server-side file system operations to identify and delete skill assets. CWE-22 (Path Traversal) identifies the root cause: the application fails to canonicalize or validate the Name parameter before constructing file paths, allowing traversal sequences such as '../../' to escape the intended skills directory. The CPE string cpe:2.3:a:astrbotdevs:astrbot:*:*:*:*:*:*:*:* uses a wildcard version field, suggesting the flaw may exist across multiple versions, though only 4.23.6 is explicitly confirmed in the CVE description. The CVSS temporal modifier E:P (exploit public) is consistent with the publicly available POC hosted as a GitHub gist.
RemediationAI
No vendor-released patch has been identified at time of analysis; the vendor did not respond to responsible disclosure, and the CVSS remediation level is listed as undefined (RL:X). As an immediate compensating control, administrators should restrict access to the /api/skills/delete endpoint using network-level ACLs or a reverse proxy allowlist, limiting it to trusted internal IP ranges only - this reduces remote exploitability without affecting other API functionality. Application-layer input validation enforcing strict alphanumeric or allowlisted characters on the Name parameter would address the root cause if a code-level fix can be applied directly. Deploying AstrBot behind an authenticated proxy with strong credential requirements raises the bar beyond the low-privilege threshold currently sufficient for exploitation. Monitor the AstrBot GitHub repository and VulDB entry https://vuldb.com/vuln/367492 for any upstream fix or patched release. The public POC at https://gist.github.com/YLChen-007/8155cf1b9519f0a3524eea73dfeead2f can be used to test whether applied controls are effective in a controlled environment.
AstrBot versions 3.4.4 through 3.5.12 contain a path traversal vulnerability (CWE-23) in the dashboard feature that allo
Hard-coded credentials in AstrBot Dashboard (versions ≤4.16.0) enable remote unauthenticated attackers to bypass authent
Command injection in AstrBot's MCP endpoint handler (add_mcp_server function) allows authenticated remote attackers to e
Authentication bypass by spoofing in AstrBot up to version 4.25.5 allows low-privileged remote attackers to impersonate
Authorization bypass in AstrBot's dashboard API allows any authenticated low-privileged user to enumerate and read chat
Server-side request forgery in AstrBot's dashboard MCP Test Endpoint allows low-privileged authenticated users to coerce
Server-side request forgery in AstrBotDevs AstrBot up to version 4.25.2 allows authenticated low-privilege users to make
Injection in AstrBot 4.23.6 allows authenticated remote attackers to manipulate input through the `_sanitize_prompt_desc
AstrBot versions up to 4.22.1 allow authenticated remote attackers to bypass sandbox restrictions via malicious file upl
Authorization bypass in AstrBotDevs AstrBot 4.24.2 enables remote low-privilege authenticated attackers to manipulate th
Incorrect authorization in AstrBot 4.23.6 allows remote low-privileged attackers to bypass filesystem path restrictions
Path traversal in AstrBot dashboard file upload allows authenticated remote attackers to write files outside intended di
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today