{"id":"CVE-2025-58179","published":"2025-09-04T23:36:44Z","modified":"2025-09-05T14:53:29Z","title":"Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpoint","vendor":"withastro","product":"astro","tier":"core","eol":null,"affectedVersions":[{"vendor":"withastro","product":"astro","versions":[">= 11.0.3, < 12.6.6"]}],"description":{"text":"Astro is a web framework for content-driven websites. Versions 11.0.3 through 12.6.5 are vulnerable to SSRF when using Astro's Cloudflare adapter. When configured with output: 'server' while using the default imageService: 'compile', the generated image optimization endpoint doesn't check the URLs it receives, allowing content from unauthorized third-party domains to be served. a A bug in impacted versions of the @astrojs/cloudflare adapter for deployment on Cloudflare’s infrastructure, allows an attacker to bypass the third-party domain restrictions and serve any content from the vulnerable origin. This issue is fixed in version 12.6.6.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":7.2,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.0087,"percentile":0.58803,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-04-30","exploitedFirstSeen":null,"ransomware":false,"evidence":[],"evidenceTotal":0,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-918","name":"Server-Side Request Forgery"}],"references":[{"url":"https://github.com/withastro/astro/security/advisories/GHSA-qpr4-c339-7vq8","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/withastro/astro/commit/9ecf3598e2b29dd74614328fde3047ea90e67252","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"npm","package":"@astrojs/cloudflare","vulnerableRanges":[">=11.0.3, <12.6.6"],"patched":["12.6.6"],"from":["GHSA-qpr4-c339-7vq8"],"provenance":"source"}],"advisories":[{"id":"GHSA-qpr4-c339-7vq8","url":"https://github.com/advisories/GHSA-qpr4-c339-7vq8","severity":"HIGH","ecosystem":"npm","package":"@astrojs/cloudflare","vulnerableRanges":[">=11.0.3, <12.6.6"],"patched":["12.6.6"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2025-26878","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-26878","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2025-11-11","earliestUrl":"https://github.com/shitodcy/CVE-2025-58179-Check","repos":[{"name":"shitodcy/CVE-2025-58179-Check","url":"https://github.com/shitodcy/CVE-2025-58179-Check","stars":2,"created":"2025-11-11"}]},"nuclei":[{"id":"CVE-2025-58179","name":"Astro Cloudflare Adapter - Server Side Request Forgery","severity":"high","path":"http/cves/2025/CVE-2025-58179.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-58179.yaml"}],"first":{"date":"2025-11-11","source":"PoC-in-GitHub","url":"https://github.com/shitodcy/CVE-2025-58179-Check"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2025-09-04","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-58179","provenance":"source"},{"date":"2025-11-11","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/shitodcy/CVE-2025-58179-Check","provenance":"source"}],"speed":{"daysToPublicExploit":68,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":61.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 185 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":11.76,"detail":"percentile 0.5880"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.04,"detail":"base score 7.2"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-withastro-astro-cve-2025-58179","children":[{"from":"CVE-2025-58179","to":"CVE-2025-59837","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"This vulnerability exists due to an incomplete fix for CVE-2025-58179.","from":"CVE.org","in":"CVE-2025-59837"}]},{"from":"CVE-2025-58179","to":"CVE-2026-41321","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"This vulnerabiity is caused by an incomplete fix for CVE-2025-58179.","from":"CVE.org","in":"CVE-2026-41321"},{"kind":"osv-related","provenance":"source","id":"GHSA-88gm-j2wx-58h6","via":"reference","url":"https://github.com/advisories/GHSA-qpr4-c339-7vq8"}]}]}}