This vulnerability in AstrBotDevs AstrBot 4.23.6 involves improper validation of the 'Name' parameter in the /api/skills/delete API endpoint, enabling an attacker to perform path traversal attacks. Such manipulation can allow unauthorized access to files outside the intended directory scope. The vulnerability is remotely exploitable without user interaction and has a CVSS 4.0 base score of 5.3, indicating medium severity. No official fix or patch has been published, and the vendor has not responded to disclosure attempts. Public exploit code is available, which may facilitate attacks.

Successful exploitation of this vulnerability could allow an attacker to access or delete files outside the authorized directory structure on the affected system. This may lead to unauthorized data exposure or modification. However, the CVSS vector indicates limited impact on confidentiality, integrity, and availability (low to medium impact). There is no indication of privilege escalation or remote code execution from the provided data.

No official patch or remediation is currently available from the vendor, and the vendor has not responded to disclosure attempts. Organizations using AstrBot 4.23.6 should consider implementing compensating controls such as restricting access to the vulnerable API endpoint, employing web application firewalls to detect and block path traversal attempts, and monitoring for suspicious activity targeting this endpoint. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.