CVE-2026-126364: Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems
Astro is a web framework for content-driven websites. From 5.14.3 until 7.4.7, Astro's /image endpoint compared the requested local-image path with the build output directory without preserving case on case-sensitive filesystems. A sibling directory whose path differed from the output directory only by letter case could therefore pass the containment check, allowing an unauthenticated requester to read image files accepted by the image service from outside the output directory. Exploitation required on-demand rendering with the @astrojs/node adapter, a case-sensitive filesystem, and a preexisting case-variant sibling directory; ordinary traversal to unrelated paths was already rejected. This issue is fixed in Astro version 7.4.7.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Astroto a version that resolves this vulnerability.Fixed in 7.4.7
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Exposure requires Astro on versions from 5.14.3 through 7.4.6 using on-demand rendering with the @astrojs/node adapter on a case-sensitive filesystem. A preexisting sibling directory whose path differs from the build output directory only by letter case must also exist.
What access does an attacker need to exploit it?
An attacker can exploit the issue without authentication by requesting the /_image endpoint. The accessible files are limited to image files accepted by the image service within the case-variant sibling directory; ordinary traversal to unrelated paths is rejected.
Are default static Astro deployments affected?
The issue requires on-demand rendering with the @astrojs/node adapter. Deployments that do not use that configuration are not described as affected.
What should be done if an immediate upgrade is not possible?
Remove or rename any sibling directory that differs from the build output directory only by letter case, where operationally feasible. This eliminates the preexisting case-variant path condition required for exploitation.
How can I determine whether the issue has been remediated?
Upgrade Astro to version 7.4.7, which fixes the issue. Also verify that the deployment does not retain a case-variant sibling directory next to the build output directory.