PT-2026-45243 · Astrbotdevs · Astrbot

Eric-A · Published 2026-06-01 · Updated 2026-06-01 · CVE-2026-10211

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AstrBotDevs AstrBot version 4.23.6

Description An issue exists in the normalize rw path() function within the astrbot/core/tools/computer tools/fs.py file. This flaw allows for incorrect authorization and can be triggered remotely.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of the normalize rw path() function to minimize the risk of exploitation.

Exploit

Incorrect Authorization

Improper Authorization

Weakness Enumeration

CWE-863

CWE-285

Related Identifiers

CVE-2026-10211

Affected Products

Astrbot

References · 8

• 🔥 https://gist.github.com/YLChen-007/b5e4671ff68e4f9001d977180ef4f081 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-10211 · Security Note
• https://vuldb.com/submit/821921 · Note
• https://vuldb.com/vuln/367490/cti · Note
• https://vuldb.com/vuln/367490 · Note
• https://t.me/cveNotify/165403 · Telegram Post
• https://t.me/CVEtracker/55421 · Telegram Post
• https://vuldb.com/cve/CVE-2026-10211 · Note