EUVD-2026-45315
GHSA-g69g-pch9-xj9r
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable dashboard requires low-privilege auth (PR:L); SSRF yields limited read/request capability with no confirmed availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was detected in AstrBotDevs AstrBot up to 4.25.2. This affects the function update_plugin/update_all_plugins of the file astrbot/dashboard/routes/plugin.py of the component Plugin Update Handler. The manipulation of the argument download_url/download_urls/proxy results in server-side request forgery. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Server-side request forgery in AstrBotDevs AstrBot up to version 4.25.2 allows authenticated low-privilege users to make the server issue arbitrary HTTP requests by injecting a malicious URL into the download_url, download_urls, or proxy arguments of the plugin update handler. The affected endpoint resides in astrbot/dashboard/routes/plugin.py within the update_plugin and update_all_plugins functions. A public proof-of-concept exploit exists on GitHub, and the vendor did not respond to the coordinated disclosure, leaving users without an official patch.
Technical ContextAI
AstrBot is an AI chatbot framework with a web-based dashboard component. The vulnerable code is in the Plugin Update Handler (astrbot/dashboard/routes/plugin.py), which accepts user-supplied URLs for downloading or updating plugins. CWE-918 (Server-Side Request Forgery) describes a root cause where a server-side application fetches a remote resource using a URL controlled by user input without validating the destination. The affected CPE is cpe:2.3:a:astrbotdevs:astrbot:*:*:*:*:*:*:*:*, covering all versions through 4.25.2. Because the proxy parameter is also injectable, an attacker can route server-initiated requests through an arbitrary host, compounding the SSRF risk.
RemediationAI
No vendor-released patch has been identified at time of analysis; the vendor did not respond to disclosure. As an immediate compensating control, restrict access to the AstrBot dashboard to trusted administrator accounts only - this reduces the low-privilege attack surface since PR:L is required for exploitation. Network-level egress filtering on the host running AstrBot should be applied to prevent the server from reaching internal metadata endpoints (e.g., 169.254.169.254), internal API gateways, or other sensitive network segments - this limits SSRF blast radius without requiring application changes. If the plugin update feature is not operationally required, disabling or blocking access to the /plugin update routes at the reverse-proxy layer is the most effective workaround with minimal side effects (plugin updates must then be performed manually). Monitor outbound HTTP requests from the AstrBot process for anomalous destinations. Check VulDB (https://vuldb.com/vuln/379789) and the AstrBot GitHub repository for patch releases.
AstrBot versions 3.4.4 through 3.5.12 contain a path traversal vulnerability (CWE-23) in the dashboard feature that allo
Hard-coded credentials in AstrBot Dashboard (versions ≤4.16.0) enable remote unauthenticated attackers to bypass authent
Command injection in AstrBot's MCP endpoint handler (add_mcp_server function) allows authenticated remote attackers to e
Authentication bypass by spoofing in AstrBot up to version 4.25.5 allows low-privileged remote attackers to impersonate
Authorization bypass in AstrBot's dashboard API allows any authenticated low-privileged user to enumerate and read chat
Server-side request forgery in AstrBot's dashboard MCP Test Endpoint allows low-privileged authenticated users to coerce
Path traversal in AstrBot 4.23.6 allows authenticated remote attackers to manipulate the Name parameter of the /api/skil
Injection in AstrBot 4.23.6 allows authenticated remote attackers to manipulate input through the `_sanitize_prompt_desc
AstrBot versions up to 4.22.1 allow authenticated remote attackers to bypass sandbox restrictions via malicious file upl
Authorization bypass in AstrBotDevs AstrBot 4.24.2 enables remote low-privilege authenticated attackers to manipulate th
Incorrect authorization in AstrBot 4.23.6 allows remote low-privileged attackers to bypass filesystem path restrictions
Path traversal in AstrBot dashboard file upload allows authenticated remote attackers to write files outside intended di
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today