GobyVuls/AstrBot install-upload Command Execution Vulnerability (CVE-2025-55449).md at master

0 Fork 0

mirror of https://github.com/gobysec/GobyVuls.git synced 2026-10-24 08:54:28 +00:00

Files

T

Document the command execution vulnerability in AstrBot.

2025-11-18 16:59:46 +08:00

AstrBot /api/plugin/install-upload Command Execution Vulnerability (CVE-2025-55449)

Vulnerability	AstrBot /api/plugin/install-upload Command Execution Vulnerability (CVE-2025-55449)
Chinese name	AstrBot /api/plugin/install-upload 命令执行漏洞（CVE-2025-55449）
CVSS core	9.0
FOFA Query (click to view the results directly)	[(title="仪表盘" && body="AstrBot")]
Number of assets affected	1100+
Description	FAstrBot is a common dashboard management tool widely used in enterprise environments. This vulnerability exists in the /api/plugin/install-upload interface of AstrBot. Attackers can exploit this vulnerability by sending specially crafted requests to execute arbitrary commands, potentially leading to full control of the server.
Impact	This vulnerability allows attackers to execute arbitrary commands on the affected server, potentially leading to full server control, sensitive data leakage, and service disruption with severe consequences.
Affected versions	< 3.5.18