Submit #792653: AstrBotDevs AstrBot 4.22.1 Arbitrary Code Execution via Plugin Uploadinfo

TitelAstrBotDevs AstrBot 4.22.1 Arbitrary Code Execution via Plugin Upload
BeschreibungAstrBot versions up to and including 4.22.1 allow authenticated users to achieve arbitrary code execution on the server by uploading a malicious plugin ZIP file via the /api/plugin/install-upload endpoint. The uploaded plugin's Python code is dynamically loaded via __import__() without any code signing verification, sandboxing, or content validation, allowing an attacker to execute arbitrary Python code in the context of the AstrBot server process.
Quelle⚠️ https://github.com/AstrBotDevs/AstrBot/issues/7168
Benutzer
 Yu_Bao (UID 89348)
Einreichung30.03.2026 05:27 (vor 6 Monaten)
Moderieren11.04.2026 10:50 (12 days later)
StatusAkzeptiert
VulDB Eintrag356977 [AstrBotDevs AstrBot bis 4.22.1 install-upload Endpoint plugin.py install_plugin_upload Datei erweiterte Rechte]
Punkte20

Want to know what is going to be exploited?

We predict KEV entries!