SEC.co
Emergency

By weakness (CWE)

CWE-647: related vulnerabilities

CVEs classified under CWE-647. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

1 published vulnerability

Known exploited (KEV)CriticalHighMediumAll recent
  • CVE-2026-59731HIGH 8.2

    Astro 6.4.7 has a path traversal vulnerability in how it authorizes access to protected routes. The issue arises because Astro stops decoding URL paths after reaching a certain limit during authorization checks, but then performs additional decoding during route matching. An attacker can craft a specially encoded URL that bypasses authorization controls and accesses restricted content. This is fixed in Astro 6.4.8.