PT-2026-32149

CVE-2026-6117

Published

2026-04-12

Updated

2026-04-12

Description by

CVSS 2.0

6.5

Medium

MetricsAV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AstrBot versions up to 4.22.1

Description A security issue exists in AstrBotDevs AstrBot up to version 4.22.1. The install plugin upload function within the astrbot/dashboard/routes/plugin.py file is susceptible to a sandbox issue due to manipulation of the File argument. This issue can be exploited remotely. The exploit has been publicly disclosed.

Recommendations Versions prior to 4.22.1 should be used.

Exploitability

Exploit

Fix

Impacts

Researchers

Yu_Bao

Vendors

Affected products

Weakness enumeration

CWE-265

CWE-264