This vulnerability involves a path traversal flaw in the AstrBotDevs AstrBot product, affecting versions 4.23.0 through 4.23.5. The flaw is located in the post_file function within the File Upload Handler component, where improper validation of the filename parameter allows an attacker to traverse directories on the server remotely. This could potentially lead to unauthorized file access or modification. The vendor has released a patch in version 4.23.6 (commit aaec41e5054569ceaa1113593a34da7568e2d211) to fix this issue. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to low impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to perform path traversal via the filename argument in the file upload handler, potentially accessing or modifying files outside the intended directory. The impact is rated medium with a CVSS score of 5.3, indicating limited but non-negligible risk to confidentiality, integrity, and availability.

Upgrade AstrBot to version 4.23.6 or later, which contains the official patch (commit aaec41e5054569ceaa1113593a34da7568e2d211) addressing this path traversal vulnerability. No other mitigations are specified or required once the upgrade is applied.