PT-2026-60922 · Astrbot · Astrbot

Eric-D · CVE-2026-16077 · Published 2026-07-18 · Updated 2026-07-18

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions AstrBot versions prior to 4.25.6

Description An issue exists in the Filesystem Computer-Use Tool within the normalize rw path() function of the astrbot/core/tools/computer tools/fs.py file. A local attacker can perform a manipulation that results in link following, which occurs when the software follows a symbolic link to access a file or directory outside the intended scope.

Recommendations Update to a version newer than 4.25.5. As a temporary mitigation, restrict local access to the system to prevent exploitation of the normalize rw path() function.

Exploit

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2026-16077

Affected Products

Astrbot

References · 7

• 🔥 https://gist.github.com/YLChen-007/d2581be79bb3caf9a032b0614dfc7728 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-16077 · Security Note
• https://vuldb.com/vuln/379792/cti · Note
• https://vuldb.com/cve/CVE-2026-16077 · Note
• https://twitter.com/VulmonFeeds/status/2078379558361772160 · Twitter Post
• https://vuldb.com/vuln/379792 · Note
• https://vuldb.com/submit/852865 · Note