CVE-2025-64757

LOW

Astro < 5.14.3 - Path Traversal

Title source: rule
STIX 2.1

Description

Astro is a web framework. Prior to version 5.14.3, a vulnerability has been identified in the Astro framework's development server that allows arbitrary local file read access through the image optimization endpoint. The vulnerability affects Astro development environments and allows remote attackers to read any image file accessible to the Node.js process on the host system. This issue has been patched in version 5.14.3.

Scores

CVSS v3 3.5
EPSS 0.0002
EPSS Percentile 6.0%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-22 CWE-23
Status published
Products (2)
astro/astro < 5.14.3
npm/astro 0 - 5.14.3npm
Published Nov 19, 2025
Tracked Since Feb 18, 2026