Local Image Exposure in Astro Web Framework by Astro

CVE-2026-126364

What is CVE-2026-126364?

The Astro web framework has a vulnerability in its /_image endpoint affecting versions from 5.14.3 to 7.4.6. This flaw arises from a comparison between the requested local image path and the build output directory that does not consider case sensitivity. As a result, an attacker could exploit a sibling directory with a path that differs only in letter case, circumventing security checks and gaining unauthorized access to image files accepted by the image service. To exploit this vulnerability, the attacker would need a case-sensitive filesystem, occur on-demand rendering using the @astrojs/node adapter, and a preexisting case-variant sibling directory, as traditional traversal to unrelated paths is denied. The issue is resolved in Astro version 7.4.7.

References