CVE-2025-64757

LOW

3.5

Descripcion

Astro is a web framework. Prior to version 5.14.3, a vulnerability has been identified in the Astro framework's development server that allows arbitrary local file read access through the image optimization endpoint. The vulnerability affects Astro development environments and allows remote attackers to read any image file accessible to the Node.js process on the host system. This issue has been patched in version 5.14.3.

Detalles CVE

Puntuacion CVSS v3.13.5

SeveridadLOW

Vector CVSSCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Vector de ataqueADJACENT_NETWORK

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioREQUIRED

Publicado11/19/2025

Ultima modificacion11/20/2025

Fuentenvd

Avistamientos honeypot0

Productos afectados

astro:astro

Debilidades (CWE)

CWE-22CWE-23

Referencias

https://github.com/withastro/astro/commit/b8ca69b97149becefaf89bf21853de9c905cdbb7(security-advisories@github.com)

https://github.com/withastro/astro/security/advisories/GHSA-x3h8-62x9-952g(security-advisories@github.com)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.