astro-notion-blog CVE-2026-117183

Requires a network-reachable deployment of astro-notion-blog 0.13.0 whose FeaturedImage component processes an attacker-controlled URL/path; the traversal is triggered through that component's handling of the image location, with no authentication (PR:N), no user interaction (UI:N), and low complexity (AC:L). The specific parameter name and exact trigger within FeaturedImage are not described in the available sources. Limiting factors: exploitation is confined to version 0.13.0 as named, and requires the FeaturedImage image-serving path to be exposed and reachable by the attacker; the trigger is not described beyond 'a crafted URL', so whether this occurs at build time or on a running server is unverified.

The signals point to a moderate, bounded priority rather than an urgent emergency. The provided CVSS base score is 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), describing a remote, low-complexity, unauthenticated vector - a profile that normally justifies attention. However, exploitation probability is low: EPSS is 0.24% (16th percentile), and the vulnerability is NOT listed in CISA KEV, so there is no confirmed active exploitation. The vuln.today decision label is 'this_week', consistent with a real but non-emergency item. A notable internal conflict exists: the input CVSS vector sets I:N (no integrity impact), yet the description explicitly states attackers can 'overwrite files on the server' - file overwrite is a direct integrity impact, so the supplied vector appears to understate severity; verify with the reporter. No SSVC exploitation/automatable/technical-impact decision points were supplied, so that framework cannot be cross-referenced. A public PoC reference exists (a dedicated GitHub repository named for the CVE) but it is not verified as working exploit code. Weighing these together: a credible unauthenticated path-traversal with read/write potential, but low real-world exploitation signal and a niche affected product - treat as a near-term patch item, not a drop-everything event.

A remote, unauthenticated attacker sends a crafted URL to the FeaturedImage component of an exposed astro-notion-blog 0.13.0 instance, embedding directory-traversal sequences to escape the intended image directory. This lets them read sensitive files outside that directory and, per the description, overwrite files on the server. A public PoC reference exists for this CVE, though it is not verified as working exploit code; the CVSS AV:N/AC:L/PR:N/UI:N profile indicates no authentication, user interaction, or special timing is required.