CVE-2026-10213 | AstrBotDevs AstrBot 4.23.6 API Endpoint /api/skills/delete Name path traversal

A vulnerability was found in AstrBotDevs AstrBot 4.23.6. It has been classified as critical. This vulnerability affects unknown code of the file /api/skills/delete of the component API Endpoint. Performing a manipulation of the argument Name results in path traversal.

This vulnerability is identified as CVE-2026-10213. The attack can be initiated remotely. Additionally, an exploit exists.

The vendor was contacted early about this disclosure but did not respond in any way.