Executive brief
Astro is a popular web framework for building content-driven websites. When a non-root base path is configured, the framework failed to properly validate path boundaries when stripping that base from incoming requests. This allowed an attacker to craft URLs (e.g., `/appX/admin` when base is `/app`) that bypassed middleware-level authorization checks, reaching protected admin routes without authentication.
Technical details
This is an authorization bypass vulnerability in Astro's request routing logic (CWE-187: Partial Comparison). The framework's base path stripping implementation used a simple string-prefix match without validating path-segment boundaries. When configured with a base like "/app", a request to "/appX/admin" (or "/app2/admin", "/app-/admin") was incorrectly stripped to "/admin" and routed to the protected admin endpoint. However, middleware security checks that inspected context.url.pathname still saw the original "/appX/admin" path, creating a discrepancy between the route resolver and the middleware. An unauthenticated remote attacker could exploit this by requesting URLs with single-character extensions of the base path, bypassing pathname-based authentication. The fix, released in version 7.2.4, now requires that base path stripping occurs only at path-segment boundaries, ensuring both routing and middleware observe the same pathname.
Affected products
- Astro Astro <= 7.2.3
Timeline
- 2026-09-08: disclosed: Advisory published
- 2026-08-19: patched: Fix released in version 7.2.4