EUVD-2026-21710
GHSA-rf4q-qfjf-vw22
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
8DescriptionCVE.org
A vulnerability was found in AstrBotDevs AstrBot up to 4.22.1. This issue affects the function install_plugin_upload of the file astrbot/dashboard/routes/plugin.py of the component install-upload Endpoint. The manipulation of the argument File results in sandbox issue. The attack can be executed remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
AstrBot versions up to 4.22.1 allow authenticated remote attackers to bypass sandbox restrictions via malicious file uploads to the install-upload endpoint (install_plugin_upload function), enabling arbitrary code execution with limited information disclosure and integrity impact. The vulnerability exists in the plugin installation mechanism and has publicly available exploit code; the vendor has been notified but has not yet responded with a patch.
Technical ContextAI
AstrBot is a Python-based bot framework that manages plugin installation through a dashboard web interface. The vulnerability resides in the install_plugin_upload function within astrbot/dashboard/routes/plugin.py, which handles file uploads for plugin installation. The underlying issue is a sandbox escape (CWE-265: Improper Access Control) where insufficient validation of uploaded plugin files allows an authenticated user to manipulate the File argument to bypass intended security boundaries. The attack vector is network-based (AV:N) with low complexity (AC:L), requiring only user-level privileges (PR:L) and no user interaction (UI:N). The scope remains unchanged (S:U), meaning the impact is limited to the vulnerable component itself rather than other systems or resources on the host.
RemediationAI
Upgrade AstrBot to a version newer than 4.22.1 as soon as a patched release becomes available; check the GitHub repository (https://github.com/AstrBotDevs/AstrBot/) for release announcements. As of the time of analysis, no vendor-released patch has been confirmed due to lack of vendor response. Until a patch is available, restrict access to the plugin installation endpoint (/dashboard/routes/plugin install-upload) to trusted administrators only, and implement network-level controls (firewall rules, VPN access) to limit dashboard access to authorized personnel. Review plugin installation logs for suspicious activity and validate all plugin files before installation. Monitor the project's GitHub issues (especially https://github.com/AstrBotDevs/AstrBot/issues/7168) for security updates.
AstrBot versions 3.4.4 through 3.5.12 contain a path traversal vulnerability (CWE-23) in the dashboard feature that allo
Hard-coded credentials in AstrBot Dashboard (versions ≤4.16.0) enable remote unauthenticated attackers to bypass authent
Command injection in AstrBot's MCP endpoint handler (add_mcp_server function) allows authenticated remote attackers to e
Authentication bypass by spoofing in AstrBot up to version 4.25.5 allows low-privileged remote attackers to impersonate
Authorization bypass in AstrBot's dashboard API allows any authenticated low-privileged user to enumerate and read chat
Server-side request forgery in AstrBot's dashboard MCP Test Endpoint allows low-privileged authenticated users to coerce
Server-side request forgery in AstrBotDevs AstrBot up to version 4.25.2 allows authenticated low-privilege users to make
Path traversal in AstrBot 4.23.6 allows authenticated remote attackers to manipulate the Name parameter of the /api/skil
Injection in AstrBot 4.23.6 allows authenticated remote attackers to manipulate input through the `_sanitize_prompt_desc
Authorization bypass in AstrBotDevs AstrBot 4.24.2 enables remote low-privilege authenticated attackers to manipulate th
Incorrect authorization in AstrBot 4.23.6 allows remote low-privileged attackers to bypass filesystem path restrictions
Path traversal in AstrBot dashboard file upload allows authenticated remote attackers to write files outside intended di
Same weakness CWE-265 – Privilege Issues
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today