CVE-2026-16077

MEDIUM

AstrBotDevs AstrBot Filesystem Computer-Use Tool fs.py _normalize_rw_path link following

Title source: cna

Description

A vulnerability was found in AstrBotDevs AstrBot up to 4.25.5. Impacted is the function _normalize_rw_path of the file astrbot/core/tools/computer_tools/fs.py of the component Filesystem Computer-Use Tool. Performing a manipulation results in link following. The attack is only possible with local access. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (5)

Core 5

Core References

Vdb Entry, Technical Description vdb-entry technical-description

VDB-379792 | AstrBotDevs AstrBot Filesystem Computer-Use Tool fs.py _normalize_rw_path link following

https://vuldb.com/vuln/379792

Signature, Permissions Required signature permissions-required

VDB-379792 | CTI Indicators (IOB, IOC, IOA)

https://vuldb.com/vuln/379792/cti

Third Party Advisory third-party-advisory

CVE-2026-16077 | CVE Analysis and Report

https://vuldb.com/cve/CVE-2026-16077

Third Party Advisory third-party-advisory

Submit #852865 | AstrBotDevs AstrBot <= 4.25.5 Improper Link Resolution Before File Access (CWE-59)

https://vuldb.com/submit/852865

Exploit exploit

https://gist.github.com/YLChen-007/d2581be79bb3caf9a032b0614dfc7728

Scores

CVSS v3 5.3

EPSS 0.0017

EPSS Percentile 6.4%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-59

Status published

Products (6)

AstrBotDevs/AstrBot 4.25.0

AstrBotDevs/AstrBot 4.25.1

AstrBotDevs/AstrBot 4.25.2

AstrBotDevs/AstrBot 4.25.3

AstrBotDevs/AstrBot 4.25.4

AstrBotDevs/AstrBot 4.25.5

Published Jul 18, 2026

Tracked Since Jul 18, 2026