Local File Read Vulnerability in Astro Framework by Astro
CVE-2025-64757

3.5LOW

Key Information:

Vendor

Withastro

Status
Astro
Vendor
CVE Published:
19 November 2025

What is CVE-2025-64757?

A vulnerability has been uncovered in the Astro framework's development server that allows remote attackers to read any image file accessible by the Node.js process on the host system. This issue exists in versions prior to 5.14.3 and is particularly concerning for developers using Astro in their development environments. By exploiting this vulnerability through the image optimization endpoint, attackers can gain unauthorized access to sensitive files. Version 5.14.3 addresses this issue with crucial updates, highlighting the importance of timely upgrades for all users.

Affected Version(s)

astro < 5.14.3

References

https://github.com/withastro/astro/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/withastro/astro/commit/b8ca69b97149bec...
x_refsource_MISC

CVSS V3.1

Score:
3.5
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-64757 : Local File Read Vulnerability in Astro Framework by Astro