Executive brief
AstrBot, an AI-powered automation tool, contains a security flaw in its filesystem management component. A local user can bypass intended security boundaries to read or modify sensitive files on the host system that should be off-limits. This occurs by using file 'hardlinks' to trick the system into accessing files outside of the user's designated workspace, potentially leading to unauthorized data access or system tampering.
Technical details
A vulnerability exists in the `_normalize_rw_path` function within `astrbot/core/tools/computer_tools/fs.py` of AstrBot. The application's path validation logic in `_is_path_within_allowed_roots()` checks if a resolved pathname is within an allowed directory but fails to verify if the file object itself is a hardlink to an inode outside the restricted boundary. A local attacker with 'member' role privileges can create a hardlink inside their assigned workspace that aliases a sensitive file elsewhere on the same filesystem. When the `FileReadTool` or `FileWriteTool` is subsequently used on the in-workspace link, the application performs the operation on the external target file, bypassing the intended directory restrictions. As of the advisory date, the vendor has not responded to the disclosure.
Affected products
- AstrBotDevs AstrBot up to 4.25.5
Timeline
- 2026-06-09: disclosed: Initial discovery and public Gist publication
- 2026-07-18: advisory: CVE-2026-16077 published via VulDB/NVD