CVE-2026-84376
2026-09-02
17h18 +00:00
17h18 +00:00
指定 CVE 通知
随时了解指定 CVE 的变更。
CVE 描述
Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path from request pathnames using a string-prefix check without verifying a path-segment boundary. With base "/app", a request to "/appX/admin" resolved internally to the protected "/admin" route while middleware observed "/appX/admin" in context.url.pathname. In applications that authorize base-prefixed routes by inspecting context.url.pathname, an unauthenticated remote attacker could bypass pathname-based middleware authorization and reach protected routes. This issue is fixed in version 7.2.4.
CVE 信息
相关弱点
| 弱点名称 | 来源 | |
|---|---|---|
| Partial String Comparison The product performs a string comparison that only examines a portion of the string before determining whether there is a match. |
