Attempted directory traversal doesn't seem to be handled properly

[williamsdyyz]

Astro Info

Astro                    v7.3.1
Vite                     v8.2.2
Node                     v24.12.0
System                   Linux (x64)
Package Manager          npm
Output                   server
Adapter                  @astrojs/node (v11.1.5)
Integrations             @astrojs/mdx (v7.0.8)

If this issue only occurs in one browser, which browser is a problem?

No response

Describe the Bug

Requests like this /_image?href=/../../../.env
are resulting in HTTP 500 errors. I'm seeing this on my production server.

On a development build I also see this error
[ERROR] [vite] The request id "/home/dave/my-site/.env" is outside of Vite serving allow list.

so on the Vite dev server as least, the attempted directory traversal almost works.

Reproducible in the Stackblitz Astro empty project.

What's the expected result?

Request is validated and rejected with HTTP 400

Link to Minimal Reproducible Example

https://stackblitz.com/edit/github-d4ey1s3b?file=src%2Fpages%2Findex.astro

Participation

• I am willing to submit a pull request for this issue.

[astro-factory]

Triage complete

• Prepare the workspace: ready
• Install dependencies: complete
• Build the project: complete
• Reproduce the issue: confirmed
• Diagnose the cause: high confidence
• Verify the diagnosis: bug
• Attempt a fix: verified
• Publish the result: set triage: fix pending

---

• Reproduced: Yes — confirmed in both dev and production server modes on current main
• Exploration: Yes — View branch
• Unit Test: Yes — packages/astro/test/core-image.test.ts ("returns 400 for directory traversal paths (Attempted directory traversal doesn't seem to be handled properly #17920)")
• Priority: P3: minor bug. The directory traversal does not actually succeed in reading files (existing guards in isParentDirectory and Vite's fs.deny block it), so there is no data exposure. The issue is the misleading 500 status code instead of a proper 400, which is incorrect HTTP semantics but not a security vulnerability.

The root cause is in packages/astro/src/assets/endpoint/shared.ts. The handleImageRequest function has no validation for directory traversal segments (..) in the href query parameter. When a path like /../../../.env is passed, it flows through to loadLocalImage, which correctly blocks the access but returns undefined. The !inputBuffer fallback then returns HTTP 500 ("Internal Server Error") instead of a proper client error code. Notably, the generic.ts endpoint (used by non-Node adapters) already returns 404 for this same case, confirming the 500 in shared.ts was an oversight.

I found a potential fix for this issue. The fix adds early path traversal detection (rejecting .. segments and null bytes with 400) before any file resolution is attempted, and changes the !inputBuffer fallback from 500 to 404 to match generic.ts.

Try this fix

You can test this fix right now without waiting for a release:

# astro
npm i https://pkg.pr.new/astro@ade720b

If this fixes your issue, please leave a comment letting us know (for example
"confirmed, this fixes it"). A pull request will then be opened to get it merged.

Full Triage Report

Issue Summary

Author: @williamsdyyz
Title: Attempted directory traversal doesn't seem to be handled properly

Requests to /_image?href=/../../../.env (and similar directory traversal paths) result in HTTP 500 errors. The reporter expects these to be validated and rejected with HTTP 400.

In dev mode, the error message also reveals filesystem paths:

[ERROR] [vite] The request id "/home/dave/my-site/.env" is outside of Vite serving allow list.

Environment

• Astro: v7.3.1 (reproduced on current main)
• Vite: v8.2.2
• Node: v24.12.0
• Output mode: server
• Adapter: @astrojs/node (standalone mode)

Reproduction

1. Created a minimal Astro project with output: 'server' and @astrojs/node adapter
2. curl "http://localhost:4321/_image?href=/../../../.env" → HTTP 500 (expected 400)
3. Also confirmed in production build: same 500 response
4. Normal requests (GET /) return 200 — server is working correctly

Root Cause

In packages/astro/src/assets/endpoint/shared.ts, the handleImageRequest function:

1. parseURL extracts the href query parameter directly as transform.src with no traversal validation
2. The path flows to loadLocalImage, which blocks the access (via isParentDirectory or Vite's deny list) and returns undefined
3. The !inputBuffer fallback returns new Response('Internal Server Error', { status: 500 }) — semantically wrong for an invalid client request

The generic.ts endpoint already returns 404 for this same case, confirming the 500 was unintentional.

Security Note

No actual directory traversal succeeds — isParentDirectory in node.ts and Vite's fs.deny in dev both block file access. The issue is purely about incorrect HTTP status codes.

Fix Applied

packages/astro/src/assets/endpoint/shared.ts:

• Added early rejection of paths containing .. segments or null bytes → HTTP 400
• Changed !inputBuffer fallback from 500 → 404 (matching generic.ts)

packages/astro/test/core-image.test.ts:

• Updated "endpoint handle malformed requests" test to verify no malformed path returns 200
• Added new test "returns 400 for directory traversal paths (Attempted directory traversal doesn't seem to be handled properly #17920)" with four specific traversal patterns

All 116 tests pass. Changeset: .changeset/all-rockets-wonder.md (astro: patch).

This report was made by an LLM. The analysis may be wrong, and the potential fix might not work, but is intended as a starting point for exploring the issue.