A flaw in AstrBotDevs AstrBot, version 4.23.6, impacts the _normalize_rw_path function in fs.py. The manipulation of this function causes incorrect authorization checks, effectively allowing an attacker to bypass intended permissions on file paths. This flaw is classified as a CWE‑285 (Improper Authorization) and CWE‑863 (Improper Control of System or Network Resources). Remote callers can exploit the vulnerability to read or write files they should not have access to, potentially modifying configuration, injecting malicious content, or escalating privileges within the bot environment. The exploit has been publicly disclosed, and no public remediation is indicated from the vendor.

AstrBotDevs AstrBot version 4.23.6 is affected. No other product versions are currently listed as vulnerable.

The CVSS score is 5.3, indicating a moderate severity. The EPSS score is not available, and the vulnerability is not present in the CISA KEV catalog. Because the flaw can be triggered remotely and the vendor has not released a fix, an attacker with network access to the component that invokes _normalize_rw_path may successfully elevate privileges or manipulate files. The lack of an available patch increases the likelihood that exploitation attempts may succeed in environments that have not implemented mitigating controls.