CVE-2026-126364
Received Received - Intake

Path Traversal in Astro Framework via Case-Insensitive Check

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: GitHub, Inc.

Description
Astro is a web framework for content-driven websites. From 5.14.3 until 7.4.7, Astro's /_image endpoint compared the requested local-image path with the build output directory without preserving case on case-sensitive filesystems. A sibling directory whose path differed from the output directory only by letter case could therefore pass the containment check, allowing an unauthenticated requester to read image files accepted by the image service from outside the output directory. Exploitation required on-demand rendering with the @astrojs/node adapter, a case-sensitive filesystem, and a preexisting case-variant sibling directory; ordinary traversal to unrelated paths was already rejected. This issue is fixed in Astro version 7.4.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126364

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
astro astro From 5.14.3 (inc) to 7.4.7 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-178 The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Astro's /_image endpoint allows unauthenticated access to read image files outside the intended build output directory on case-sensitive filesystems. It occurs when a sibling directory exists with a path differing only by letter case from the output directory. The endpoint incorrectly treats these as the same due to case-insensitive path checks.

Detection Guidance

Check Astro version with 'npm list astro' or 'astro --version'. If using @astrojs/node for on-demand rendering on a case-sensitive filesystem (e.g., Linux), verify if sibling directories exist with case-variant paths like 'dist' and 'DIST'. Inspect server logs for suspicious /_image endpoint requests accessing files outside the build directory.

Impact Analysis

An attacker could read sensitive image files from restricted directories if your system uses a case-sensitive filesystem, has on-demand rendering with @astrojs/node, and has a case-variant sibling directory. The impact is limited to files the image service can process like images or SVGs.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by allowing unauthorized access to sensitive image files if specific conditions are met. Unauthorized file access may lead to exposure of personal or protected health information, violating data protection requirements under these regulations.

Mitigation Strategies

Upgrade Astro to version 7.4.7 or later immediately. Ensure the fix is applied to the core framework, not just the @astrojs/node adapter. Review filesystem permissions and remove any case-variant sibling directories that could be exploited.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126364. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...