{"data":{"id":"b2853608-43e1-4676-b0a4-a4e0e06b6502","title":"CVE-2025-48957: AstrBot is a large language model chatbot and development framework. A path traversal vulnerability present in versions…","summary":"CVE-2025-48957 is a path traversal flaw in AstrBot, a large language model chatbot and development framework, affecting versions 3.4.4 through 3.5.12. It may lead to information disclosure, including API keys for LLM providers and account passwords.","solution":"Fixed in Pull Request #1676, included in version 3.5.13; upgrading to v3.5.13 or later is strongly recommended. As a temporary workaround, edit the `cmd_config.json` file to disable the dashboard feature.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-48957","publishedAt":"2025-06-02T12:15:25.680Z","cveId":"CVE-2025-48957","cweIds":["CWE-23","CWE-22"],"cvssScore":"7.5","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["astrbot@>= 3.4.4, <= 3.5.12 (fixed: 3.5.13)"],"affectedPackageNames":["astrbot"],"affectedPackageRefs":["pypi:astrbot"],"affectedVendors":[],"affectedVendorsRaw":["AstrBot"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"AstrBot path traversal that leads to information disclosure","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00771,"epssCheckedAt":"2026-11-04T12:08:35.257Z","kevDateAdded":null,"advisoryAliases":["GHSA-cq37-g2qp-3c2p"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:53:39.286Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-05-31T03:54:13.081Z","daysToFix":-2,"fixCheckedAt":"2026-10-29T21:44:22.859Z","capecIds":["CAPEC-126"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"astrbot","fixedVersion":"3.5.13","matchedVersion":"3.5.13","fixReleasedAt":"2025-05-31T03:54:13.081Z","daysToFix":-2,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:44:22.708Z"}]}}