CVE-2025-57697: Path Traversal
AstrBot Project v3.5.22 has an arbitrary file read vulnerability in function encodeimagebs64. Since the encodeimagebs64 function defined in entities.py opens the image specified by the user in the request body and returns the image content as a base64-encoded string without checking the legitimacy of the image path, attackers can construct a series of malicious URLs to read any specified file, resulting in sensitive data leakage.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-57697?
CVE-2025-57697 has been classified with a severity that could allow unauthorized access to sensitive files.
How do I fix CVE-2025-57697?
To fix CVE-2025-57697, ensure proper validation and sanitization of user input before accessing files in the _encode_image_bs64 function.
Which versions of AstrBot are affected by CVE-2025-57697?
CVE-2025-57697 affects AstrBot Project v3.5.22 specifically.
What is the impact of CVE-2025-57697?
The impact of CVE-2025-57697 includes the possibility of arbitrary file reading, which could lead to the exposure of sensitive data.
Is there a workaround for CVE-2025-57697?
A temporary workaround for CVE-2025-57697 includes disabling user uploads until a patch is applied.