CVE-2026-10211

An authenticated non-admin attacker sends a chat message that triggers a filesystem tool call (FileWriteTool or FileEditTool) with an absolute path pointing to a globally shared skill directory (e.g., `data/skills/malicious/SKILL.md`). Because `_normalize_rw_path` only checks membership in the read-allowed roots, the write is permitted even though the user should not have write access to that directory. This allows the attacker to inject a malicious skill, which can lead to remote code execution when the skill is loaded or invoked. The attack is remote and requires only low-privilege authentication [ref_id=1].

The vulnerability resides in `astrbot/core/tools/computer_tools/fs.py`. The function `_normalize_rw_path` reuses the read-allowed roots list (which includes `data/skills`) for write and edit operations, and `_resolve_tool_path` accepts absolute paths without restriction. Both `FileWriteTool.call` and `FileEditTool.call` rely on `_normalize_rw_path`, so a restricted user can supply an absolute path such as `.../data/skills/malicious/SKILL.md` and bypass authorization.

The advisory does not provide a patch; the vendor did not respond. The recommended fix would be to introduce a separate write-allowed roots list distinct from the read-allowed roots, and to have `_normalize_rw_path` (or a dedicated write-path function) enforce membership in that write-allow list. Additionally, `_resolve_tool_path` should reject or sanitize absolute paths when the caller is restricted, or the write tools should validate that the resolved path falls within a writable workspace rather than a read-only skill directory [ref_id=1].