EUVD-2026-21710
GHSA-rf4q-qfjf-vw22
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to AstrBot dashboard
-
DeliveryNavigate to plugin installation endpoint
-
ExploitUpload crafted plugin file bypassing validation
-
ExecutionExploit sandbox escape in install_plugin_upload function
-
ImpactExecute arbitrary code within bot process
Vulnerability Assessment
| Weakness |
CWE
|
| Impact | While the CVSS score of 6.3 rates this as medium severity, multiple risk signals indicate moderate real-world priority. The exploit is publicly available and confirmed demonstrable, elevating practical risk beyond the base score. EPSS data is not provided, but the combination of public POC availability, low attack complexity, and low privilege requirement (PR:L) suggests reasonably high exploitation probability. The CVSS environmental metrics show E:P (exploit maturity is proof-of-concept code), indicating the attack is not yet widely automated but is practical. Lack of vendor response within a reasonable timeframe (RL:X = Unavailable) is concerning. The impact is confined to confidentiality, integrity, and availability of the vulnerable service (not system-wide) due to S:U, and the attack requires authentication, which naturally filters the threat to legitimate users or those who have obtained valid credentials. For organizations running AstrBot, this is a moderate-to-high priority because authenticated users can compromise the plugin system; for others, this is lower priority. The sandbox escape aspect suggests plugin code execution rather than OS-level compromise, limiting blast radius. |
| Exploit ScenarioDerived | An authenticated user with dashboard access uploads a malicious plugin file to the install-upload endpoint. The install_plugin_upload function fails to properly validate or sandbox the file contents, allowing the attacker to escape sandbox restrictions and execute arbitrary code within the AstrBot process. This grants the attacker the ability to access sensitive bot configuration data, modify plugin behavior, or disable the bot entirely. Publicly available exploit code demonstrates this is not theoretical. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 12, 2026
AstrBot versions up to 4.22.1 allow authenticated remote attackers to bypass sandbox restrictions via malicious file uploads to the install-upload endpoint (install_plugin_upload function), enabling arbitrary code execution with limited information disclosure and integrity impact. The vulnerability exists in the plugin installation mechanism and has publicly available exploit code; the vendor has been notified but has not yet responded with a patch.
RemediationAI
Upgrade AstrBot to a version newer than 4.22.1 as soon as a patched release becomes available; check the GitHub repository (https://github.com/AstrBotDevs/AstrBot/) for release announcements. As of the time of analysis, no vendor-released patch has been confirmed due to lack of vendor response. Until a patch is available, restrict access to the plugin installation endpoint (/dashboard/routes/plugin install-upload) to trusted administrators only, and implement network-level controls (firewall rules, VPN access) to limit dashboard access to authorized personnel. Review plugin installation logs for suspicious activity and validate all plugin files before installation. Monitor the project's GitHub issues (especially https://github.com/AstrBotDevs/AstrBot/issues/7168) for security updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
AstrBot is a Python-based bot framework that manages plugin installation through a dashboard web interface. The vulnerability resides in the install_plugin_upload function within astrbot/dashboard/routes/plugin.py, which handles file uploads for plugin installation. The underlying issue is a sandbox escape (CWE-265: Improper Access Control) where insufficient validation of uploaded plugin files allows an authenticated user to manipulate the File argument to bypass intended security boundaries. The attack vector is network-based (AV:N) with low complexity (AC:L), requiring only user-level privileges (PR:L) and no user interaction (UI:N). The scope remains unchanged (S:U), meaning the impact is limited to the vulnerable component itself rather than other systems or resources on the host.
Know when Astrbot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was found in AstrBotDevs AstrBot up to 4.22.1. This issue affects the function install_plugin_upload of the file astrbot/dashboard/routes/plugin.py of the component install-upload Endpoint. The manipulation of the argument File results in sandbox issue. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in AstrBotDevs AstrBot Multiple Vulnerabilities
View all 3AstrBot versions 3.4.4 through 3.5.12 contain a path traversal vulnerability (CWE-23) in the dashboard feature that allo
Hard-coded credentials in AstrBot Dashboard (versions ≤4.16.0) enable remote unauthenticated attackers to bypass authent
Incorrect authorization in AstrBot up to 4.25.5 allows remote authenticated users to bypass persona-based tool restricti
Authentication bypass by spoofing in AstrBot up to version 4.25.5 allows low-privileged remote attackers to impersonate
Authorization bypass in AstrBot's dashboard API allows any authenticated low-privileged user to enumerate and read chat
Server-side request forgery in AstrBot up to version 4.25.2 allows authenticated remote attackers to cause the server to
Server-side request forgery in AstrBot's dashboard MCP Test Endpoint allows low-privileged authenticated users to coerce
Server-side request forgery in AstrBotDevs AstrBot up to version 4.25.2 allows authenticated low-privilege users to make
Improper authorization in AstrBot's Scheduled Task Handler allows a remote low-privileged user to bypass authorization c
Path traversal in AstrBot 4.23.6 allows authenticated remote attackers to manipulate the Name parameter of the /api/skil
Injection in AstrBot 4.23.6 allows authenticated remote attackers to manipulate input through the `_sanitize_prompt_desc
Exploit-DB