EUVD-2026-45356
GHSA-78hj-h3pf-359h
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local access with low privileges required to create symlinks; no scope change occurs; limited file-level CIA impact consistent with partial read/write access outside intended directory.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was found in AstrBotDevs AstrBot up to 4.25.5. Impacted is the function _normalize_rw_path of the file astrbot/core/tools/computer_tools/fs.py of the component Filesystem Computer-Use Tool. Performing a manipulation results in link following. The attack is only possible with local access. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Symlink following in AstrBot's Filesystem Computer-Use Tool (versions up to 4.25.5) allows a low-privileged local attacker to escape intended directory restrictions and access arbitrary files by manipulating the _normalize_rw_path function in astrbot/core/tools/computer_tools/fs.py. A proof-of-concept exploit has been publicly disclosed via GitHub Gist, and the vendor did not respond to coordinated disclosure - meaning no patch is confirmed available. No public exploit identified at time of analysis as confirmed active exploitation (not in CISA KEV), but the existence of public POC code lowers the barrier for any attacker who already has local access.
Technical ContextAI
AstrBot is an open-source AI agent/chatbot framework with computer-use capabilities, including a Filesystem Computer-Use Tool that allows the AI agent to read and write files on the host system. The vulnerable function _normalize_rw_path in astrbot/core/tools/computer_tools/fs.py is responsible for sanitizing and constraining file paths to an allowed scope before file operations are performed. CWE-59 (Improper Link Resolution Before File Access - 'Link Following') indicates the function evaluates the security boundary against the symlink path itself rather than its resolved target, or resolves symlinks after the path check rather than before. An attacker can create a symbolic link inside an allowed directory that points to a sensitive target outside the permitted scope, and the function will follow the link without detecting the boundary violation. The CVSS 4.0 vector AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N confirms the attack is purely local, requires no attack preconditions beyond low privileges, and yields limited but real impact across all three CIA dimensions on the vulnerable system only.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to coordinated disclosure, and no fixed version has been confirmed from any available source. Monitor the AstrBotDevs GitHub repository and https://vuldb.com/vuln/379792 for any future patch release. As a primary compensating control, disable the Filesystem Computer-Use Tool feature in AstrBot if it is not operationally required, removing the vulnerable code path entirely; this is the most effective mitigation with no functional trade-off for deployments that do not rely on AI-driven file access. Where the feature must remain enabled, restrict the AstrBot process to a tightly scoped filesystem namespace using OS-level controls such as Linux chroot jails, user namespaces, or mandatory access control frameworks (AppArmor or SELinux) configured to deny symlink traversal outside the intended directory - note that configuring these controls correctly requires OS-level expertise and may impact AstrBot functionality. In multi-user environments, isolate each user's AstrBot instance to its own OS user account and filesystem sandbox to prevent cross-user symlink attacks.
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today