AstrBot version 3.5.22 contains an arbitrary file read vulnerability in the _encode_image_bs64 function. This function reads and base64-encodes an image file specified by the user without validating the file path, allowing attackers to read arbitrary files on the system. This can lead to sensitive data leakage. The vulnerability is tracked as CVE-2025-57697 and has a high severity score of 7.1. No patch or fix information is currently provided.