CVE-2026-10211: AstrBot 4.23.6 Path Normalization Authorization Bypass

Technical summary

The vulnerability exists in the _normalize_rw_path function within astrbot/core/tools/computer_tools/fs.py. The function fails to properly sanitize or validate file path normalization, creating an authorization bypass. This permits authenticated attackers to escape intended directory restrictions and access files outside their permitted scope. The issue is classified as both improper access control (CWE-285) and improper authorization (CWE-863), allowing an attacker to read, modify, or delete sensitive files depending on the application's file permissions context.

Business impact

An authenticated attacker exploiting this vulnerability could access confidential data, modify critical files, or corrupt application state. In environments where AstrBot processes sensitive information or manages system-level tasks, this could lead to data exfiltration, service disruption, or lateral movement within the infrastructure. The damage is amplified if AstrBot runs with elevated privileges or has access to shared file systems.

Affected systems

AstrBot version 4.23.6 is confirmed vulnerable. Earlier and later versions should be checked against vendor advisories for exposure. No official patch status has been published by the vendor. Users should consult the AstrBotDevs repository or security announcements to determine which versions contain fixes.

Exploitability

Exploitation requires valid authentication credentials to the AstrBot instance, reducing the attack surface compared to unauthenticated flaws. However, the attack is remotely triggerable and requires no user interaction once authenticated. The public disclosure of this vulnerability means that threat actors have access to detailed attack information and may have developed working exploits.

Remediation

Immediately verify your AstrBot deployment version. If running 4.23.6, contact AstrBotDevs or check their repository for available patches or workarounds. Since the vendor did not respond to early disclosure, monitor community channels and security advisories closely. As a temporary control, restrict network access to AstrBot to trusted networks and audit user accounts with AstrBot access. Consider implementing file system access controls or containerization to limit the scope of any potential compromise.

Patch guidance

Check the AstrBotDevs GitHub repository and official documentation for security advisories and updated releases. Verify the specific version numbers of any available patches before deploying. Test patches in a non-production environment first. If no official patch is available, escalate to the vendor or community for guidance on timeline and recommended interim protections.

Detection guidance

Monitor AstrBot application logs for unusual file access patterns, particularly path traversal attempts or access to files outside expected directories. Watch for authenticated sessions making unexpected file system queries. Implement file integrity monitoring on critical files that AstrBot should not normally modify. Network-level detection should focus on AstrBot API calls with suspicious path parameters. Review access logs for authenticated users with unusual activity patterns.

Why prioritize this

Although the CVSS score is medium (6.3), this vulnerability warrants prompt attention because it combines authenticated remote exploitability with public disclosure and potentially available exploit code. The authorization bypass nature means compromise could be subtle and difficult to detect. Organizations relying on AstrBot for automation or data processing should prioritize assessment and patching before widespread weaponization occurs.

Risk score, explained

The CVSS 3.1 score of 6.3 reflects: remote network-based attack vector, low attack complexity (straightforward path normalization bypass), requirement for low-level privileges (authentication), and impact to confidentiality, integrity, and availability within the affected system's scope. The score does not account for public disclosure or the vendor's lack of response, which are contextual factors elevating practical risk.

Frequently asked questions