CVE-2025-64757

LowCVSS 3.5/10Last modified Oct 18, 2026

Description

Astro is a web framework. Prior to version 5.14.3, a vulnerability has been identified in the Astro framework's development server that allows arbitrary local file read access through the image optimization endpoint. The vulnerability affects Astro development environments and allows remote attackers to read any image file accessible to the Node.js process on the host system. This issue has been patched in version 5.14.3.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22CWE-23

Affected software

No affected versions have been published.

Timeline

Published
Nov 19, 2025
Last modified
Oct 18, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-647584.8@dependencytrack/frontend is a Single Page Application (SPA) used in Dependency-Track, an open source Component Analysis platform that allowCVE-2025-647596.1Homarr is an open-source dashboard. Prior to version 1.43.3, stored XSS vulnerability exists, allowing the execution of arbitrary JavaScriptCVE-2025-64764.3A vulnerability was found in SourceCodester Gym Management System 1.0. It has been classified as problematic. Affected is an unknown functioCVE-2025-647604.3Tuleap is a free and open source suite for management of software development and collaboration. Versions of Tuleap Community Edition prior CVE-2025-647617.2OpenBao is an open source identity-based secrets management system. Prior to version 2.4.4, a privileged operator could use the identity groCVE-2025-647629.1The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. ICVE-2025-647635.3Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, when Envoy is configured in TCP proCVE-2025-647645.4Astro is a web framework. Prior to version 5.15.8, a reflected XSS vulnerability is present when the server islands feature is used in the tCVE-2025-647655.3Astro is a web framework. Prior to version 5.15.8, a mismatch exists between how Astro normalizes request paths for routing/rendering and hoCVE-2025-647665.3NixOS's Onlyoffice is a software suite that offers online and offline tools for document editing, collaboration, and management. In versionsCVE-2025-647679.1hpke-js is a Hybrid Public Key Encryption (HPKE) module built on top of Web Cryptography API. Prior to version 1.7.5, the public SenderConteCVE-2025-647697.1The Process Optimization application suite leverages connection channels/protocols that by-default are not encrypted and could become subj