Astrbot is a focused chatbot or automation framework with a narrow product scope, whose vulnerability profile centers on file-system and cryptographic handling issues including path traversal variants, out-of-bounds reads, and hard-coded cryptographic keys. These weaknesses suggest exposure in file operations and credential management within the framework's architecture; current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Astrbot over time
Signals from CVEs in this vendor scope (4 CVEs).
4 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-55449HIGH AstrBotDevs AstrBot 3.5.15 has Advanced_System_for_Text_Response_and_Bot_Operations_Tool as the hardcoded private key used to sign a JWT. | May 8, 2026 | 7.3 | 28 | NO | NO |
CVE-2025-57698HIGH AstrBot Project v3.5.22 contains a directory traversal vulnerability. The handler function install_plugin_upload of the interface '/plugin/install-upload' parses the filename from | Nov 7, 2025 | 7.5 | 25 | NO | NO |
CVE-2025-57697MEDIUM AstrBot Project v3.5.22 has an arbitrary file read vulnerability in function _encode_image_bs64. Since the _encode_image_bs64 function defined in entities.py opens the image specif | Nov 7, 2025 | 6.5 | 23 | NO | NO |
CVE-2025-48957HIGH AstrBot is a large language model chatbot and development framework. A path traversal vulnerability present in versions 3.4.4 through 3.5.12 may lead to information disclosure, suc | Jun 2, 2025 | 7.5 | 22 | NO | NO |
Signals from CVEs in this vendor scope (4 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Astrbot.
Media articles that mention a CVE ID that affects a product developed by Astrbot — matched by CVE ID, not by vendor name.