# CVE-2026-126364: Astro case-sensitive path bypass in image endpoint

Source: https://junglewise.ai/threats/cve-2026-126364-astro-is-a-web-framework-for-content-driven-websites-from-5-14-3  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-13. Updated: 2026-11-13  
License: CC BY 4.0 with a link back

CVE-2026-126364 · Severity: info · Published 2026-11-13

Astro is a web framework used to build content-driven websites. A flaw in the image serving endpoint allowed attackers to read image files from sibling directories with case-variant names (e.g., "DIST" vs "dist") on case-sensitive filesystems, potentially exposing unintended images. This required on-demand rendering and an existing case-variant sibling directory, making exploitation limited but feasible in specific configurations.

Technologies: [Astro](https://junglewise.ai/threats/technologies/astro-astro). Vendors: [Astro](https://junglewise.ai/threats/vendors/astro).

## Quick answers

**Is CVE-2026-126364 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126364 being exploited in the wild.

**How severe is CVE-2026-126364?** Informational severity, published 13 November 2026.

**Which products and versions are affected?** Astro 5.14.3 to 7.4.6.

**Is there a fix for CVE-2026-126364?** Yes: fixed in 7.4.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126364 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-126364?** Check whether you run Astro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 7.4.7

## Technical details

The /_image endpoint's path containment check incorrectly lowercased paths on all filesystems before comparison, causing case-sensitive filesystem directories differing only in capitalization to bypass the check. On case-sensitive systems, a directory like "DIST/client" would be treated as within "dist/client", allowing directory traversal to sibling paths. The vulnerability affects versions 5.14.3 through 7.4.6 with the @astrojs/node adapter, on-demand rendering enabled, and a case-sensitive filesystem with a preexisting case-variant sibling directory; it is fixed by comparing paths case-sensitively on non-Windows systems.

## Affected products

- Astro Astro 5.14.3 to 7.4.6

## Timeline

- 2026-11-13: disclosed
- 2026-11-05: patched: Astro 7.4.7 released

## References

- [https://github.com/withastro/astro/commit/7da442bb286e0c29e1c9e1add6727b7cbf434f1a](https://github.com/withastro/astro/commit/7da442bb286e0c29e1c9e1add6727b7cbf434f1a)
- [https://github.com/withastro/astro/releases/tag/astro@7.4.7](https://github.com/withastro/astro/releases/tag/astro@7.4.7)

## Related threats

- [Astro HTML injection in dynamic element rendering](https://junglewise.ai/threats/cve-2026-126361-astro-is-a-web-framework-for-content-driven-websites-prior-to-7)
- [Astro HTML injection in script and style element rendering](https://junglewise.ai/threats/cve-2026-114128-astro-is-a-web-framework-for-content-driven-websites-prior-to-7)
- [Astro CSS injection in View Transition animation values](https://junglewise.ai/threats/cve-2026-114127-astro-is-a-web-framework-for-content-driven-websites-from-7-1-0)
- [Astro: XSS in define:vars via incomplete </script> tag sanitization](https://junglewise.ai/threats/cve-2026-41067-astro-xss-in-define-vars-via-incomplete-script-tag-sanitization)
- [Astro authentication bypass via double URL encoding](https://junglewise.ai/threats/cve-2025-66202-astro-authentication-bypass-via-double-url-encoding)