Executive brief
AstrBot, a chatbot and automation framework, contains a security flaw that allows non-administrator users to write or edit files they should not have access to. By exploiting a mismatch in how the system checks file permissions, an attacker can inject malicious code into the bot's shared skills directory. This could lead to a complete takeover of the bot's functions or the underlying server when those malicious skills are executed.
Technical details
An authorization bypass exists in AstrBot's filesystem tools due to a logic error in the `_normalize_rw_path` function within `astrbot/core/tools/computer_tools/fs.py`. The application incorrectly reuses `_read_allowed_roots` (which includes global skill directories) to validate write and edit operations for restricted users. By providing an absolute path to the `FileWriteTool` or `FileEditTool`, a remote authenticated attacker with low privileges can bypass intended workspace restrictions. This allows the attacker to write arbitrary files into the `data/skills` directory, potentially leading to persistent malicious skill injection and remote code execution (RCE) when the injected skills are loaded. As of the advisory date, no official patch has been released.
Affected products
- AstrBotDevs AstrBot <= 4.23.6
Timeline
- 2026-05-06: disclosed: Initial disclosure via GitHub Gist by researcher YLChen-007
- 2026-06-01: advisory: CVE published to NVD via VulDB