# CVE-2026-16077: AstrBotDevs AstrBot link following in Filesystem Computer-Use Tool

Source: https://junglewise.ai/threats/cve-2026-16077-astrbotdevs-astrbot-link-following-in-filesystem-computer-use  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-18. Updated: 2026-07-18  
License: CC BY 4.0 with a link back

CVE-2026-16077 · Severity: medium · CVSS 5.3 · Published 2026-07-18

AstrBot, an AI-powered automation tool, contains a security flaw in its filesystem management component. A local user can bypass intended security boundaries to read or modify sensitive files on the host system that should be off-limits. This occurs by using file 'hardlinks' to trick the system into accessing files outside of the user's designated workspace, potentially leading to unauthorized data access or system tampering.

## Quick answers

**Is CVE-2026-16077 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16077 being exploited in the wild.

**How severe is CVE-2026-16077?** Medium severity, with a CVSS score of 5.3, published 18 July 2026.

**Which products and versions are affected?** AstrBotDevs AstrBot up to 4.25.5.

**Is there a fix for CVE-2026-16077?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-16077 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-16077?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the `_normalize_rw_path` function within `astrbot/core/tools/computer_tools/fs.py` of AstrBot. The application's path validation logic in `_is_path_within_allowed_roots()` checks if a resolved pathname is within an allowed directory but fails to verify if the file object itself is a hardlink to an inode outside the restricted boundary. A local attacker with 'member' role privileges can create a hardlink inside their assigned workspace that aliases a sensitive file elsewhere on the same filesystem. When the `FileReadTool` or `FileWriteTool` is subsequently used on the in-workspace link, the application performs the operation on the external target file, bypassing the intended directory restrictions. As of the advisory date, the vendor has not responded to the disclosure.

## Affected products

- AstrBotDevs AstrBot up to 4.25.5

## Timeline

- 2026-06-09: disclosed: Initial discovery and public Gist publication
- 2026-07-18: advisory: CVE-2026-16077 published via VulDB/NVD

## References

- [https://gist.github.com/YLChen-007/d2581be79bb3caf9a032b0614dfc7728](https://gist.github.com/YLChen-007/d2581be79bb3caf9a032b0614dfc7728)
- [https://vuldb.com/cve/CVE-2026-16077](https://vuldb.com/cve/CVE-2026-16077)
- [https://vuldb.com/submit/852865](https://vuldb.com/submit/852865)
- [https://vuldb.com/vuln/379792](https://vuldb.com/vuln/379792)
- [https://vuldb.com/vuln/379792/cti](https://vuldb.com/vuln/379792/cti)