CVE-2026-16077 Overview
CVE-2026-16077 is a link following vulnerability [CWE-59] in AstrBotDevs AstrBot versions up to 4.25.5. The flaw resides in the _normalize_rw_path function within astrbot/core/tools/computer_tools/fs.py, part of the Filesystem Computer-Use Tool component. An authenticated local attacker can manipulate filesystem paths through symbolic links to access or modify files outside the intended directory scope. The vendor was contacted about this disclosure but did not respond. A proof-of-concept exploit has been published publicly.
Critical Impact
Local attackers with low privileges can leverage symbolic link manipulation to read or write files outside the AstrBot sandbox, affecting confidentiality, integrity, and availability of local resources.
Affected Products
- AstrBotDevs AstrBot versions up to and including 4.25.5
- Filesystem Computer-Use Tool component (astrbot/core/tools/computer_tools/fs.py)
- Deployments exposing the _normalize_rw_path function to local users
Discovery Timeline
- 2026-07-18 - CVE-2026-16077 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-16077
Vulnerability Analysis
The vulnerability affects the _normalize_rw_path function in astrbot/core/tools/computer_tools/fs.py. This function is responsible for normalizing read/write paths within the Filesystem Computer-Use Tool. The normalization routine fails to properly resolve symbolic links before enforcing directory boundary checks. As a result, an attacker who can influence path arguments passed to the tool can point them at symlinks that redirect operations outside the sanctioned working directory. This class of flaw is categorized under [CWE-59] Improper Link Resolution Before File Access.
Root Cause
The root cause is insufficient canonicalization of filesystem paths. The _normalize_rw_path function does not evaluate whether components of the supplied path are symbolic links pointing outside the permitted root before granting access. Path validation that occurs prior to link resolution allows the attacker to bypass the intended sandbox boundary. Secure implementations must resolve the full canonical path using os.path.realpath and re-validate against the allowed root after resolution.
Attack Vector
Exploitation requires local access with low-privilege credentials on the host running AstrBot. The attacker plants a symbolic link inside the tool's working directory that references a sensitive file or directory elsewhere on the filesystem. When the Filesystem Computer-Use Tool processes a read or write operation targeting the symlink, the operation follows the link and acts on the external target. User interaction is not required. The published proof-of-concept demonstrates the technique against a default AstrBot deployment.
// No verified exploit code available for reproduction.
// See the published proof-of-concept for technical details:
// https://gist.github.com/YLChen-007/d2581be79bb3caf9a032b0614dfc7728
Detection Methods for CVE-2026-16077
Indicators of Compromise
- Unexpected symbolic links created inside AstrBot working directories or Computer-Use Tool sandbox paths
- File access events from the AstrBot process targeting paths outside its configured working directory
- Modifications to sensitive files (configuration, credentials, SSH keys) traced back to the AstrBot service account
Detection Strategies
- Audit filesystem calls made by the AstrBot process for readlink, symlink, and open operations that traverse outside the intended sandbox root
- Enable Linux audit rules on the AstrBot working directory to log symlink creation events
- Review AstrBot application logs for path arguments containing unexpected relative traversal or references to external directories
Monitoring Recommendations
- Continuously monitor the AstrBot service account for file operations targeting /etc, /root, or user home directories outside its sandbox
- Alert on the creation of new symbolic links within Computer-Use Tool workspaces where such links are not part of normal workflow
- Correlate local user activity with AstrBot filesystem events to identify potential exploitation attempts
How to Mitigate CVE-2026-16077
Immediate Actions Required
- Restrict local access to the host running AstrBot to trusted users only
- Run AstrBot under a dedicated low-privilege service account with minimal filesystem permissions
- Disable or gate the Filesystem Computer-Use Tool until an updated release is available
- Monitor the AstrBot GitHub repository for a fixed release addressing _normalize_rw_path
Patch Information
No vendor patch is available at the time of publication. The vendor did not respond to disclosure. Administrators should track the AstrBot repository for security updates beyond version 4.25.5. Additional technical context is available in the VulDB CVE-2026-16077 entry.
Workarounds
- Deploy AstrBot inside a container or chroot environment that constrains filesystem visibility to a minimal directory tree
- Mount the Computer-Use Tool workspace with the nosymfollow option where supported by the underlying filesystem
- Apply mandatory access controls (AppArmor or SELinux) to prevent the AstrBot process from following symlinks outside its designated workspace
- Periodically scan Computer-Use Tool workspaces for unauthorized symbolic links and remove them
# Example AppArmor snippet restricting AstrBot filesystem access
/opt/astrbot/workspace/** rw,
deny /etc/** rwklx,
deny /root/** rwklx,
deny /home/*/.ssh/** rwklx,
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
