CVE-2025-64757 - CVE House

Back to Database

Status published Low CVE-2025-64757

Astro Development Server is Vulnerable to Arbitrary Local File Read

3.5 CVSS

Vulnerability Description

Astro is a web framework. Prior to version 5.14.3, a vulnerability has been identified in the Astro framework's development server that allows arbitrary local file read access through the image optimization endpoint. The vulnerability affects Astro development environments and allows remote attackers to read any image file accessible to the Node.js process on the host system. This issue has been patched in version 5.14.3.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-64757

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from withastro

View All →

Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765

Astro Cloudflare adapter has a Stored Cross Site Scripting vulnerability in /_image endpoint

Astro middleware authentication checks based on url.pathname can be bypassed via url encoded values

Astro is vulnerable to Reflected XSS via the server islands feature

Astro development server error page vulnerable to reflected Cross-site Scripting

Affected Vendor

withastro

View all reports →

Affected Software

astro

Vulnerable Versions:

< 5.14.3

Timeline

Official Publish: November 19th, 2025

Last Modified: November 19th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1005 Data from Local System

T1552 Unsecured Credentials

Credential Access

T1565.001 Stored Data Manipulation

T1105 Ingress Tool Transfer

Command and Control

T1565 Data Manipulation