## AstrBot /api/plugin/install-upload Command Execution Vulnerability (CVE-2025-55449)
|   **Vulnerability**  | 	AstrBot /api/plugin/install-upload Command Execution Vulnerability (CVE-2025-55449)|
| :----:   | :-----|
|  **Chinese name**  |AstrBot /api/plugin/install-upload 命令执行漏洞（CVE-2025-55449） |
| **CVSS core**  | 		9.0  |
| **FOFA Query**  (click to view the results directly)|  [(title="仪表盘" && body="AstrBot")]
| **Number of assets affected**  | 1100+ |
| **Description**  |FAstrBot is a common dashboard management tool widely used in enterprise environments. This vulnerability exists in the /api/plugin/install-upload interface of AstrBot. Attackers can exploit this vulnerability by sending specially crafted requests to execute arbitrary commands, potentially leading to full control of the server. |
| **Impact** | This vulnerability allows attackers to execute arbitrary commands on the affected server, potentially leading to full server control, sensitive data leakage, and service disruption with severe consequences.|
| **Affected versions** |< 3.5.18|

![](https://img.cdn1.vip/i/691c30c367842_1763455171.webp)