CVE-2026-6117 | AstrBotDevs AstrBot up to 4.22.1 install-upload Endpoint plugin.py install_plugin_upload File sandbox (Issue 7168)

A vulnerability was found in AstrBotDevs AstrBot up to 4.22.1 and classified as critical. This issue affects the function install_plugin_upload of the file astrbot/dashboard/routes/plugin.py of the component install-upload Endpoint. The manipulation of the argument File results in sandbox issue.

This vulnerability is identified as CVE-2026-6117. The attack can be executed remotely. Additionally, an exploit exists.

The project was informed of the problem early through an issue report but has not responded yet.