CVE-2025-57697: 
Python Análisis y mitigación de vulnerabilidades

AstrBot Project v3.5.22 contains an arbitrary file read vulnerability (CVE-2025-57697) discovered in November 2025. The vulnerability exists in the _encode_image_bs64 function defined in entities.py. This vulnerability was first published to the CVE List on November 7, 2025, and was subsequently included in the NVD dataset (NVD).

The vulnerability stems from the _encode_image_bs64 function in entities.py, which opens user-specified images from the request body and returns the image content as a base64-encoded string. The critical security flaw is that the function does not validate the legitimacy of the image path before processing. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L (NVD).

The vulnerability allows attackers to construct malicious URLs to read any specified file on the system, potentially leading to sensitive data leakage. This arbitrary file read capability compromises the confidentiality of the system by exposing files that should be protected (NVD).