Path Traversal in AstrBot Filesystem Computer-Use Tool

Executive Summary

CVE-2026-16077 is a vulnerability in AstrBot up to version 4.25.5 that allows a local user to bypass filesystem restrictions by exploiting hardlink aliases. The issue occurs because AstrBot checks if a file path is within an allowed workspace but does not verify if the file is a hardlink pointing to an out-of-workspace file. This enables unauthorized read and write operations on files outside the intended workspace if they share the same inode.

Useful 0 Not Useful 0

Detection Guidance

Check for AstrBot versions up to 4.25.5 using package managers like pip or by inspecting the installed version. Look for suspicious hardlink creation within restricted workspaces pointing to files outside allowed boundaries. Commands: pip show astrbot or astrbot --version. Review filesystem access logs for unauthorized read/write operations.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows a local attacker with access to the system to read or modify files outside the intended workspace boundary. If successful, it could lead to unauthorized access to sensitive data or manipulation of critical files on the host system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized local users to access or modify files outside intended workspace boundaries through hardlink exploitation. Unauthorized file access may lead to exposure of sensitive personal or health data, violating confidentiality requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update AstrBot to the latest version beyond 4.25.5 immediately. Restrict local user permissions to prevent hardlink creation. Monitor filesystem boundaries and disable AstrBot's access to sensitive directories until patched.

Useful 0 Not Useful 0