CVE-2025-48957

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-48957
AstrBot is a large language model chatbot and development framework. A path traversal vulnerability present in versions 3.4.4 through 3.5.12 may lead to information disclosure, such as API keys for LLM providers, account passwords, and other sensitive data. The vulnerability has been addressed in Pull Request #1676 and is included in version 3.5.13. As a workaround, users can edit the `cmd_config.json` file to disable the dashboard feature as a temporary workaround. However, it is strongly recommended to upgrade to version v3.5.13 or later to fully resolve this issue.
CVSS

No CVSS.

References
Link Resource
https://github.com/AstrBotDevs/AstrBot/commit/cceadf222c46813c7f41115b40d371e7eb91e492 Patch
https://github.com/AstrBotDevs/AstrBot/issues/1675 Exploit Issue Tracking
https://github.com/AstrBotDevs/AstrBot/pull/1676 Exploit Issue Tracking Patch
https://github.com/AstrBotDevs/AstrBot/security/advisories/GHSA-cq37-g2qp-3c2p Exploit Vendor Advisory
https://github.com/AstrBotDevs/AstrBot/security/advisories/GHSA-cq37-g2qp-3c2p Exploit Vendor Advisory
https://www.vicarius.io/vsociety/posts/cve-2025-48957-detect-astrbot-dashboard-vulnerability?prevUrl=wizard Exploit Third Party Advisory
https://www.vicarius.io/vsociety/posts/cve-2025-48957-mitigate-astrbot-dashboard-vulnerability?prevUrl=wizard Mitigation Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:astrbot:astrbot:*:*:*:*:*:*:*:*
History

25 Jun 2025, 17:39

Type Values Removed Values Added
CPE cpe:2.3:a:astrbot:astrbot:*:*:*:*:*:*:*:*
CWE CWE-22
First Time Astrbot astrbot
Astrbot
References () https://www.vicarius.io/vsociety/posts/cve-2025-48957-mitigate-astrbot-dashboard-vulnerability?prevUrl=wizard - () https://www.vicarius.io/vsociety/posts/cve-2025-48957-mitigate-astrbot-dashboard-vulnerability?prevUrl=wizard - Mitigation, Third Party Advisory
References () https://github.com/AstrBotDevs/AstrBot/commit/cceadf222c46813c7f41115b40d371e7eb91e492 - () https://github.com/AstrBotDevs/AstrBot/commit/cceadf222c46813c7f41115b40d371e7eb91e492 - Patch
References () https://github.com/AstrBotDevs/AstrBot/issues/1675 - () https://github.com/AstrBotDevs/AstrBot/issues/1675 - Exploit, Issue Tracking
References () https://www.vicarius.io/vsociety/posts/cve-2025-48957-detect-astrbot-dashboard-vulnerability?prevUrl=wizard - () https://www.vicarius.io/vsociety/posts/cve-2025-48957-detect-astrbot-dashboard-vulnerability?prevUrl=wizard - Exploit, Third Party Advisory
References () https://github.com/AstrBotDevs/AstrBot/pull/1676 - () https://github.com/AstrBotDevs/AstrBot/pull/1676 - Exploit, Issue Tracking, Patch
References () https://github.com/AstrBotDevs/AstrBot/security/advisories/GHSA-cq37-g2qp-3c2p - () https://github.com/AstrBotDevs/AstrBot/security/advisories/GHSA-cq37-g2qp-3c2p - Exploit, Vendor Advisory

23 Jun 2025, 18:15

Type Values Removed Values Added
References
  • () https://www.vicarius.io/vsociety/posts/cve-2025-48957-mitigate-astrbot-dashboard-vulnerability?prevUrl=wizard -
  • () https://www.vicarius.io/vsociety/posts/cve-2025-48957-detect-astrbot-dashboard-vulnerability?prevUrl=wizard -

02 Jun 2025, 17:15

Type Values Removed Values Added
CWE CWE-23

02 Jun 2025, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-02 12:15

Updated : 2025-06-25 17:39

NVD link : CVE-2025-48957

Mitre link : CVE-2025-48957

JSON object : View

Products Affected

astrbot

  • astrbot
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')