CVE-2025-48957

AstrBot is a large language model chatbot and development framework. A path traversal vulnerability present in versions 3.4.4 through 3.5.12 may lead to information disclosure, such as API keys for LLM providers, account passwords, and other sensitive data. The vulnerability has been addressed in Pull Request #1676 and is included in version 3.5.13. As a workaround, users can edit the `cmd_config.json` file to disable the dashboard feature as a temporary workaround. However, it is strongly recommended to upgrade to version v3.5.13 or later to fully resolve this issue.

• CWE-23
• CWE-22

• https://github.com/AstrBotDevs/AstrBot/commit/cceadf222c46813c7f41115b40d371e7eb91e492Patch
• https://github.com/AstrBotDevs/AstrBot/issues/1675Exploit, Issue Tracking
• https://github.com/AstrBotDevs/AstrBot/pull/1676Exploit, Issue Tracking, Patch
• https://github.com/AstrBotDevs/AstrBot/security/advisories/GHSA-cq37-g2qp-3c2pExploit, Vendor Advisory
• https://www.vicarius.io/vsociety/posts/cve-2025-48957-detect-astrbot-dashboard-vulnerability?prevUrl=wizardExploit, Third Party Advisory
• https://www.vicarius.io/vsociety/posts/cve-2025-48957-mitigate-astrbot-dashboard-vulnerability?prevUrl=wizardMitigation, Third Party Advisory
• https://github.com/AstrBotDevs/AstrBot/security/advisories/GHSA-cq37-g2qp-3c2pExploit, Vendor Advisory

Published

Jun 2, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-48951Auth0-PHP is a PHP SDK for Auth0 Authentication and Manageme…9.3
• CVE-2025-48952NetAlertX is a network, presence scanner, and alert framewor…9.4
• CVE-2025-48953Umbraco is an ASP.NET content management system (CMS). Start…6.5
• CVE-2025-48954Discourse is an open-source discussion platform. Versions pr…6.1
• CVE-2025-48955Para is a multitenant backend server/framework for object pe…6.2
• CVE-2025-48956vLLM is an inference and serving engine for large language m…7.5
• CVE-2025-48958Froxlor is open source server administration software. Prior…5.4
• CVE-2025-48959Local privilege escalation due to insecure file permissions.…6.7
• CVE-2025-4896A vulnerability was found in Tenda AC10 16.03.10.13 and clas…7.5
• CVE-2025-48960Weak server key used for TLS encryption. The following produ…5.9
• CVE-2025-48961Local privilege escalation due to insecure folder permission…7.3
• CVE-2025-48962Sensitive information disclosure due to SSRF. The following …4.3