SZB-733069a612
astro-notion-blog 0.13.0 path traversal allows reading and overwriting server files
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- astro-notion-blog
- Product
- astro-notion-blog
- First seen
Summary
The EUVD entry EUVD-2026-114179 reports a path traversal flaw in the FeaturedImage component of astro-notion-blog 0.13.0 that allows reading and overwriting files on the server via a crafted URL. No CVSS score is listed in the item.
If you use astro-notion-blog
Check the project for a fixed release and upgrade beyond 0.13.0
Audit server files for unexpected changes if the blog is deployed
Restrict write permissions for the web application's user
What the sources say 1
· Mastodon: “A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape the intended directory, as well as read and overwrite files on the server via a crafted URL.” Source