CVE-2026-10213

MediumCVSS 5.4/10Last modified Jul 22, 2026

Description

A security flaw has been discovered in AstrBotDevs AstrBot 4.23.6. This vulnerability affects unknown code of the file /api/skills/delete of the component API Endpoint. Performing a manipulation of the argument Name results in path traversal. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Jun 1, 2026
Last modified: Jul 22, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1021307.2Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowed an administrator to influenc CVE-2026-1021317.2Kiteworks Email Protection Gateway rejected certain configuration settings, but its validation did not recognize every form in which they co CVE-2026-1021327.2An administrative import function in Kiteworks Core did not verify that the requesting administrator was entitled to create the privileged i CVE-2026-1021336.6An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in a user-supplied pat CVE-2026-1021345.4Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform's central authentic CVE-2026-1021356.6On a Kiteworks Email Protection Gateway cluster with database replication enabled, a party trusted by the cluster could submit a crafted ser CVE-2026-1021366.3In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a value through an interna CVE-2026-1021374.1An authenticated administrator could bypass the content validation applied to an administrative file upload and store a file containing dang CVE-2026-1021383.3An authenticated administrator on a node with an optional, separately licensed gateway role enabled could supply a connector URL that the se CVE-2026-1021396.5An authorization check in the large file exchange feature of Kiteworks Email Protection Gateway did not correctly establish that the request CVE-2026-102147.3A weakness has been identified in zhayujie chatgpt-on-wechat up to 2.0.8. This issue affects the function _get_safety_warning of the file ag CVE-2026-1021404.9An authenticated administrator could initiate an administrative import using a file whose contents were not fully verified, because the impo