CVE-2025-64757

Astro is a web framework. Prior to version 5.14.3, a vulnerability has been identified in the Astro framework's development server that allows arbitrary local file read access through the image optimization endpoint. The vulnerability affects Astro development environments and allows remote attackers to read any image file accessible to the Node.js process on the host system. This issue has been patched in version 5.14.3.

CVSS v3 3.5 LOW

3.5^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.1 / Impact : 1.4

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/withastro/astro/commit/b8ca69b97149becefaf89bf21853de9c905cdbb7	Patch
https://github.com/withastro/astro/security/advisories/GHSA-x3h8-62x9-952g	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:astro:astro:*:*:*:*:*:node.js:*:*

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Astro es un framework web. Versiones anteriores a la versión 5.14.3, se ha identificado una vulnerabilidad en el servidor de desarrollo del framework Astro que permite el acceso arbitrario de lectura de archivos locales a través del endpoint de optimización de imágenes. La vulnerabilidad afecta a los entornos de desarrollo de Astro y permite a atacantes remotos leer cualquier archivo de imagen accesible para el proceso de Node.js en el sistema anfitrión. Este problema ha sido parcheado en la versión 5.14.3.

Information

Published : 2025-11-19 17:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-64757

Mitre link : CVE-2025-64757

CVE.ORG link : CVE-2025-64757

JSON object : View

Products Affected

astro

astro

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-23

Relative Path Traversal

{"id": "CVE-2025-64757", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64757", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-19T21:04:14.914682Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "withastro", "product": "astro", "versions": [{"status": "affected", "version": "< 5.14.3"}]}]}], "published": "2025-11-19T17:15:52.460", "references": [{"url": "https://github.com/withastro/astro/commit/b8ca69b97149becefaf89bf21853de9c905cdbb7", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/withastro/astro/security/advisories/GHSA-x3h8-62x9-952g", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-23"}]}], "descriptions": [{"lang": "en", "value": "Astro is a web framework. Prior to version 5.14.3, a vulnerability has been identified in the Astro framework's development server that allows arbitrary local file read access through the image optimization endpoint. The vulnerability affects Astro development environments and allows remote attackers to read any image file accessible to the Node.js process on the host system. This issue has been patched in version 5.14.3."}, {"lang": "es", "value": "Astro es un framework web. Versiones anteriores a la versi\u00f3n 5.14.3, se ha identificado una vulnerabilidad en el servidor de desarrollo del framework Astro que permite el acceso arbitrario de lectura de archivos locales a trav\u00e9s del endpoint de optimizaci\u00f3n de im\u00e1genes. La vulnerabilidad afecta a los entornos de desarrollo de Astro y permite a atacantes remotos leer cualquier archivo de imagen accesible para el proceso de Node.js en el sistema anfitri\u00f3n. Este problema ha sido parcheado en la versi\u00f3n 5.14.3."}], "lastModified": "2026-10-18T20:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:astro:astro:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "48394CBD-D26B-4176-875E-32B9467D6157", "versionEndExcluding": "5.14.3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}