CVE-2025-58752

Summary

Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, any HTML files on the machine were served regardless of the server.fs settings. Only apps that explicitly expose the Vite dev server to the network (using –host or server.host config option) and use appType: 'spa' (default) or appType: 'mpa' are affected. This vulnerability also affects the preview server. The preview server allowed HTML files not under the output directory to be served. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.

Affected Software

VendorProductVersion RangeStatus
vitejsvite< 5.4.20affected
vitejsvite>= 6.0.0, < 6.3.6affected
vitejsvite>= 7.0.0, < 7.0.7affected
vitejsvite>= 7.1.0, < 7.1.5affected

Weaknesses

  • CWE-23: CWE-23: Relative Path Traversal
  • CWE-200: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-284: CWE-284: Improper Access Control

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: partial

Additional References

References