AstrBot version 3.5.22 and earlier contain a directory traversal vulnerability in the install_plugin_upload handler. This flaw allows an attacker to specify a crafted filename in the upload request, which is used without validation to save files to arbitrary locations on the file system. This can lead to unauthorized file writes and potential system compromise.