A path traversal flaw exists in the post_file function of AstrBotDevs AstrBot’s File Upload Handler (chat.py). The vulnerability allows an attacker to supply arbitrary filenames, causing the server to write or overwrite files outside the intended upload directory. This can enable the upload of malicious scripts or overwrite critical configuration files, potentially granting the attacker remote code execution or unauthorized system access.

All AstrBotDevs AstrBot installations running version 4.23.5 or earlier are affected. The fix is released in version 4.23.6; upgrading removes the flaw.

The flaw has a CVSS score of 5.3, indicating moderate severity. Although EPSS data is not available and the issue is not in CISA KEV, the attack can be launched remotely and the exploit is publicly available. The potential impact of gaining code execution depends on the underlying environment; in a web context it could lead to full compromise.