提出 #792653: AstrBotDevs AstrBot 4.22.1 Arbitrary Code Execution via Plugin Upload情報

タイトルAstrBotDevs AstrBot 4.22.1 Arbitrary Code Execution via Plugin Upload
説明AstrBot versions up to and including 4.22.1 allow authenticated users to achieve arbitrary code execution on the server by uploading a malicious plugin ZIP file via the /api/plugin/install-upload endpoint. The uploaded plugin's Python code is dynamically loaded via __import__() without any code signing verification, sandboxing, or content validation, allowing an attacker to execute arbitrary Python code in the context of the AstrBot server process.
ソース⚠️ https://github.com/AstrBotDevs/AstrBot/issues/7168
ユーザー
 Yu_Bao (UID 89348)
送信2026年03月30日 05:27 (5 月 ago)
モデレーション2026年04月11日 10:50 (12 days later)
ステータス承諾済み
VulDBエントリ356977 [AstrBotDevs AstrBot 迄 4.22.1 install-upload Endpoint plugin.py install_plugin_upload ファイル 特権昇格]
ポイント20

Do you want to use VulDB in your project?

Use the official API to access entries easily!