CVE-2025-57697

AstrBot Project v3.5.22 has an arbitrary file read vulnerability in function _encode_image_bs64

Medium · published November 7, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
26.3
In the wild
Unconfirmed
What it is

AstrBot Project v3.5.22 has an arbitrary file read vulnerability in function _encode_image_bs64. Since the _encode_image_bs64 function defined in entities.py opens the image specified by the user in the request body and returns the image content as a base64-encoded string without checking the legitimacy of the image path, attackers can construct a series of malicious URLs to read any specified file, resulting in sensitive data leakage.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00340 · 26.3th percentile
Published
2025-11-07T00:00Z
EPSS history
Timeline
  • 07 NOV 00:00Z
    AstrBot Project v3.5.22 has an arbitrary file read vulnerability in function _encode_image_bs64
    cvelistv5