astrbotdevs/astrbot Security Advisories | GitStock

low2026-06-01

CVE-2026-10212-AstrBot: Manipulation of astr_main_agent's session_id parameter leads to authorization bypass

GHSA-r6vm-4xwg-w69h

low2026-05-17

CVE-2026-8754-AstrBot: File upload vulnerability in the function post_file of the file astrbot/dashboard/routes/chat.py

GHSA-f63h-wc26-pmvc

medium2026-05-01

CVE-2026-7579-AstrBot Makes Use of Hard-coded Password

GHSA-mq9q-25hm-g4gp

low2026-04-25

CVE-2026-6984-AstrBot has Incomplete Filtering of Special Elements

GHSA-h3rr-9wqj-v3c6

critical2025-11-14

CVE-2025-55449-AstrBot is vulnerable to RCE with hard-coded JWT signing keys

GHSA-4m32-cjv7-f425

medium2025-11-07

CVE-2025-57697-AstrBot has an arbitrary file read vulnerability in function _encode_image_bs64

GHSA-vm2f-46xc-5jc3

high2025-11-07

CVE-2025-57698-AstrBot contains a directory traversal vulnerability

GHSA-xrj9-mw57-j34v

high2025-06-04

CVE-2025-48957-AstrBot Has Path Traversal Vulnerability in /api/chat/get_file

GHSA-cq37-g2qp-3c2p