An Astro‑Notion‑Blog 0.13.0 implementation contains a path traversal flaw in its FeaturedImage component. The flaw permits an attacker who can craft a URL to bypass the intended directory boundaries, thereby reading arbitrary files and overwriting any accessible file on the server. This can expose sensitive configuration data or allow an attacker to replace or inject code, giving a pathway to potential remote code execution.

astro‑notion‑blog version 0.13.0 installations that utilize the FeaturedImage component. The vulnerability exists regardless of the deployment environment and is not vendor‑published, so any deployment of this open‑source package is potentially affected.

The CVE has no EPSS data and is not listed in CISA KEV, but path traversal flaws are generally considered high risk. The attack vector is remote, requiring only a crafted HTTP request to the application. If the server runs the application with sufficient file system permissions, the attacker can read or overwrite arbitrary files. Without a patch this vulnerability could be used to modify site files or inject malicious code, leading to broader compromise of the hosting environment.