CVE-2026-16077
AstrBotDevs AstrBot Filesystem Computer-Use Tool fs.py _normalize_rw_path link following
- State
- Published
- Severity
- 4.8 Medium
- Published
- Jul 18, 2026
- Updated
- Jul 20, 2026
- Reserved
- Jul 17, 2026
Description
A vulnerability was found in AstrBotDevs AstrBot up to 4.25.5. Impacted is the function _normalize_rw_path of the file astrbot/core/tools/computer_tools/fs.py of the component Filesystem Computer-Use Tool. Performing a manipulation results in link following. The attack is only possible with local access. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 4.8 Medium | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 5.3 Medium | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 4.3 Medium | AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
- CWE-59 Link Following
Affected Products
| Product | Versions |
|---|---|
AstrBotAstrBotDevs |
|
References
- VDB-379792 | AstrBotDevs AstrBot Filesystem Computer-Use Tool fs.py _normalize_rw_path link followingvdb-entrytechnical-description
- VDB-379792 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2026-16077 | CVE Analysis and Reportthird-party-advisory
- Submit #852865 | AstrBotDevs AstrBot <= 4.25.5 Improper Link Resolution Before File Access (CWE-59)third-party-advisory
- https://gist.github.com/YLChen-007/d2581be79bb3caf9a032b0614dfc7728exploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.