https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 17:44:29 +0000 https://db.gcve.eu/vuln/cve-2026-84376 <p><strong>Affected:</strong> withastro astro</p> <p>Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path from request pathnames using a string-prefix check without verifying a path-segment boundary. With base &#34;/app&#34;, a request to &#34;/appX/admin&#34; resolved internally to the protected &#34;/admin&#34; route while middleware observed &#34;/appX/admin&#34; in context.url.pathname. In applications that authorize base-prefixed routes by inspecting context.url.pathname, an unauthenticated remote attacker could bypass pathname-based middleware authorization and reach protected routes. This issue is fixed in version 7.2.4.</p> <p><strong>Affected:</strong> withastro astro</p> <p>Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path from request pathnames using a string-prefix check without verifying a path-segment boundary. With base &#34;/app&#34;, a request to &#34;/appX/admin&#34; resolved internally to the protected &#34;/admin&#34; route while middleware observed &#34;/appX/admin&#34; in context.url.pathname. In applications that authorize base-prefixed routes by inspecting context.url.pathname, an unauthenticated remote attacker could bypass pathname-based middleware authorization and reach protected routes. This issue is fixed in version 7.2.4.</p> https://db.gcve.eu/vuln/cve-2026-84376