EUVD-2026-33532
GHSA-c6q5-v72x-3cqq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in AstrBotDevs AstrBot 4.23.6. Affected by this issue is the function _normalize_rw_path of the file astrbot/core/tools/computer_tools/fs.py. This manipulation causes incorrect authorization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Incorrect authorization in AstrBot 4.23.6 allows remote low-privileged attackers to bypass filesystem path restrictions via the _normalize_rw_path function in astrbot/core/tools/computer_tools/fs.py, resulting in unauthorized read, write, or access to files outside the intended scope. The vulnerability stems from improper path normalization logic that fails to enforce access controls correctly, enabling authenticated users to escape sandboxed file boundaries. A public proof-of-concept exploit exists on GitHub, and the vendor was unresponsive to coordinated disclosure, leaving no official patch available at time of analysis.
Technical ContextAI
AstrBot is an AI bot framework by AstrBotDevs. The vulnerable code resides in the computer tools filesystem module (astrbot/core/tools/computer_tools/fs.py), specifically in the _normalize_rw_path function responsible for canonicalizing file paths before read/write operations. CWE-863 (Incorrect Authorization) indicates the function validates or normalizes the path but fails to correctly enforce access control decisions - a classic path traversal authorization bypass where the normalized path is not properly checked against permitted directories before the operation proceeds. The CPE string cpe:2.3:a:astrbotdevs:astrbot:*:*:*:*:*:*:*:* uses a wildcard version range, suggesting NVD has not yet scoped the affected versions beyond the reported 4.23.6. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the vulnerability is exploitable remotely with low complexity by any authenticated user, with no user interaction required.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to coordinated disclosure, and no fixed version is referenced in available sources. Defenders running AstrBot should consider the following compensating controls: disable or restrict access to the computer tools filesystem feature (astrbot/core/tools/computer_tools/) if it is not operationally required, as this eliminates the vulnerable attack surface entirely; enforce strict OS-level filesystem permissions on the directories accessible by the AstrBot process, using chroot jails or container-level volume mounts scoped to only the required directories, to limit the blast radius of path traversal even if exploitation occurs; and restrict the AstrBot instance to trusted authenticated users only, reducing the pool of potential attackers given PR:L is required. Monitor VulDB (https://vuldb.com/cve/CVE-2026-10211) and the AstrBotDevs repository for any upstream fix. The public POC at https://gist.github.com/YLChen-007/b5e4671ff68e4f9001d977180ef4f081 can be used to test whether mitigations are effective in your deployment.
AstrBot versions 3.4.4 through 3.5.12 contain a path traversal vulnerability (CWE-23) in the dashboard feature that allo
Hard-coded credentials in AstrBot Dashboard (versions ≤4.16.0) enable remote unauthenticated attackers to bypass authent
Command injection in AstrBot's MCP endpoint handler (add_mcp_server function) allows authenticated remote attackers to e
Authentication bypass by spoofing in AstrBot up to version 4.25.5 allows low-privileged remote attackers to impersonate
Authorization bypass in AstrBot's dashboard API allows any authenticated low-privileged user to enumerate and read chat
Server-side request forgery in AstrBot's dashboard MCP Test Endpoint allows low-privileged authenticated users to coerce
Server-side request forgery in AstrBotDevs AstrBot up to version 4.25.2 allows authenticated low-privilege users to make
Path traversal in AstrBot 4.23.6 allows authenticated remote attackers to manipulate the Name parameter of the /api/skil
Injection in AstrBot 4.23.6 allows authenticated remote attackers to manipulate input through the `_sanitize_prompt_desc
AstrBot versions up to 4.22.1 allow authenticated remote attackers to bypass sandbox restrictions via malicious file upl
Authorization bypass in AstrBotDevs AstrBot 4.24.2 enables remote low-privilege authenticated attackers to manipulate th
Path traversal in AstrBot dashboard file upload allows authenticated remote attackers to write files outside intended di
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today