CVE-2025-57698: Path Traversal
AstrBot Project v3.5.22 contains a directory traversal vulnerability. The handler function installpluginupload of the interface '/plugin/install-upload' parses the filename from the request body provided by the user, and directly uses the filename to assign to filepath without checking the validity of the filename. The variable filepath is then passed as a parameter to the function file.save, so that the file in the request body can be saved to any location in the file system through directory traversal.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-57698?
CVE-2025-57698 is classified as a medium severity vulnerability due to its potential for directory traversal exploits.
How do I fix CVE-2025-57698?
To fix CVE-2025-57698, validate and sanitize the filename input before using it to set the file path in the handler function.
Which version of AstrBot Project is affected by CVE-2025-57698?
AstrBot Project v3.5.22 is the version known to be affected by CVE-2025-57698.
What type of vulnerability is CVE-2025-57698?
CVE-2025-57698 is a directory traversal vulnerability.
What can attackers achieve with CVE-2025-57698?
Attackers can exploit CVE-2025-57698 to access arbitrary files on the server not intended for public access.