CVE-2026-10211

MediumCVSS 6.3/10Last modified Jul 22, 2026

Description

A vulnerability was determined in AstrBotDevs AstrBot 4.23.6. Affected by this issue is the function _normalize_rw_path of the file astrbot/core/tools/computer_tools/fs.py. This manipulation causes incorrect authorization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-285 CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Jun 1, 2026
Last modified: Jul 22, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1021105.9An endpoint used during initial appliance setup did not require authentication and did not correctly enforce its intended state precondition CVE-2026-1021114.9Kiteworks did not enforce the maximum permitted value for a configurable security-policy setting. An authenticated administrator could set t CVE-2026-1021127.8A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend CVE-2026-1021137.8A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend CVE-2026-1021147.2A command injection vulnerability in Kiteworks could allow a high-privileged authenticated administrator to execute arbitrary operating-syst CVE-2026-1021159.8Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the ema CVE-2026-1021167.2-A weakness could have allowed an authenticated Kiteworks Email Protection Gateway administrator to write a file outside its intended locati CVE-2026-1021177.2On deployments where the remote-support capability is licensed and enabled, an authenticated System Administrator who also possessed the key CVE-2026-1021187.8A local privilege escalation vulnerability in Kiteworks could have allowed an attacker with an existing shell under a low-privileged service CVE-2026-1021197.2A path traversal weakness in an optional, non-default administrative feature allowed an authenticated administrator to move files to uninten CVE-2026-102126.3A vulnerability was identified in AstrBotDevs AstrBot 4.24.2. This affects the function astr_main_agent of the file astrbot/core/astr_main_a CVE-2026-1021208.8A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution on one node of a cl