Every CVE Search/ Get API key

CVE-2025-31486

Vite allows server.fs.deny to be bypassed with .svg or relative paths

5.3 MediumPublic exploitFix available

Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

40.5%Up 40.4 points since Apr 4, 2025
90%50%10%1%

What each source reports

CVE List Score used 5.3

Vite allows server.fs.deny to be bypassed with .svg or relative paths

Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5.

Record
CVE-2025-31486
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-200, CWE-284
Updated
2026-11-02
EUVDEUVD-2025-9734 5.3

Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5.

Record
EUVD-2025-9734
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-xcj6-pq6g-qj4x 5.3

Vite allows server.fs.deny to be bypassed with .svg or relative paths

Summary

The contents of arbitrary files can be returned to the browser.

Impact

Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.

Details

.svg

Requests ending with .svg are loaded at this line. https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290 By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the restriction was able to bypass.

This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+.

relative paths

The check was applied before the id normalization. This allowed requests to bypass with relative paths (e.g. ../../).

PoC

npm create vite@latest
cd vite-project/
npm install
npm run dev

send request to read etc/passwd

curl 'http://127.0.0.1:5173/etc/passwd?.svg?.wasm?init'

curl 'http://127.0.0.1:5173/@fs/x/x/x/vite-project/?/../../../../../etc/passwd?import&?raw'
Record
GHSA-xcj6-pq6g-qj4x
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-200, CWE-284
Updated
2026-11-02
NVD 5.3

Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5.

Record
CVE-2025-31486
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-200, CWE-284
Updated
2026-11-02
OSV 5.3

Vite allows server.fs.deny to be bypassed with .svg or relative paths

Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5.

Record
CVE-2025-31486
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-200, CWE-284
Updated
2026-11-04
OSVGHSA-xcj6-pq6g-qj4x 5.3

Vite allows server.fs.deny to be bypassed with .svg or relative paths

Summary

The contents of arbitrary files can be returned to the browser.

Impact

Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.

Details

.svg

Requests ending with .svg are loaded at this line. https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290 By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the restriction was able to bypass.

This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+.

relative paths

The check was applied before the id normalization. This allowed requests to bypass with relative paths (e.g. ../../).

PoC

npm create vite@latest
cd vite-project/
npm install
npm run dev

send request to read etc/passwd

curl 'http://127.0.0.1:5173/etc/passwd?.svg?.wasm?init'

curl 'http://127.0.0.1:5173/@fs/x/x/x/vite-project/?/../../../../../etc/passwd?import&?raw'
Record
GHSA-xcj6-pq6g-qj4x
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness
CWE-200, CWE-284
Updated
2026-11-02
Show 9 moreShow less
OSVCLSA-2026-1775089661 No score

TuxCare security update for 2 packages (5 CVEs)

TuxCare rebuilt 2 packages to address 5 CVEs. Fixed in 5.4.14-tuxcare.1.

Record
CLSA-2026-1775089661
Updated
2026-11-02
OSVCLSA-2026-1775176118 No score

TuxCare security update for vite (6 CVEs)

TuxCare rebuilt vite to address 6 CVEs. Fixed in 4.5.5-tuxcare.1.

Record
CLSA-2026-1775176118
Updated
2026-11-02
OSVCLSA-2026-1777509608 No score

TuxCare security update for vite (11 CVEs)

TuxCare rebuilt vite to address 11 CVEs. Fixed in 2.9.18-tuxcare.1.

Record
CLSA-2026-1777509608
Updated
2026-11-02
OSVCLSA-2026-1777509610 No score

TuxCare security update for vite (6 CVEs)

TuxCare rebuilt vite to address 6 CVEs. Fixed in 3.2.11-tuxcare.1.

Record
CLSA-2026-1777509610
Updated
2026-11-02
OSVCLSA-2026-1789031855 No score

TuxCare security update for vite (16 CVEs)

TuxCare rebuilt vite to address 16 CVEs. Fixed in 4.1.5-tuxcare.1.

Record
CLSA-2026-1789031855
Updated
2026-11-02
OSVCLSA-2026-1791666893 No score

TuxCare security update for vite (1 CVE)

TuxCare rebuilt vite to address 1 CVE. Fixed in 5.4.10-tuxcare.2.

Record
CLSA-2026-1791666893
Updated
2026-11-02
OSVCLSA-2026-1791795546 No score

TuxCare security update for vite (2 CVEs)

TuxCare rebuilt vite to address 2 CVEs. Fixed in 5.0.12-tuxcare.4.

Record
CLSA-2026-1791795546
Updated
2026-11-02
OSVCLSA-2026-1792225950 No score

TuxCare security update for @vitejs/plugin-react (11 CVEs)

TuxCare rebuilt @vitejs/plugin-react to address 11 CVEs. Fixed in 2.9.18-tuxcare.1.

Record
CLSA-2026-1792225950
Updated
2026-11-02
OSVCLSA-2026-1792225952 No score

TuxCare security update for @vitejs/plugin-react (6 CVEs)

TuxCare rebuilt @vitejs/plugin-react to address 6 CVEs. Fixed in 3.2.11-tuxcare.1.

Record
CLSA-2026-1792225952
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
vite
npm
 6.2.0 up to 6.2.5
6.2.5
vite
npm
 6.1.0 up to 6.1.4
6.1.4
vite
npm
 6.0.0 up to 6.0.14
6.0.14
vite
npm
 5.0.0 up to 5.4.17
5.4.17
vite
npm
 before 4.5.12
4.5.12
@vitejs/plugin-legacy
TuxCare:npm
From an advisory covering 4 CVEs
 5.4.14-tuxcare.0 up to 5.4.14-tuxcare.1, plus listed versions
5.4.14
5.4.14-tuxcare.1
vite
TuxCare:npm
From an advisory covering 4 CVEs
 5.4.14-tuxcare.0 up to 5.4.14-tuxcare.1, plus listed versions
5.4.14
5.4.14-tuxcare.1
vite
TuxCare:npm
From an advisory covering 6 CVEs
 4.5.5-tuxcare.0 up to 4.5.5-tuxcare.1, plus listed versions
4.5.5
4.5.5-tuxcare.1
vite
TuxCare:npm
From an advisory covering 11 CVEs
 2.9.18-tuxcare.0 up to 2.9.18-tuxcare.1, plus listed versions
2.9.18
2.9.18-tuxcare.1
vite
TuxCare:npm
From an advisory covering 6 CVEs
 3.2.11-tuxcare.0 up to 3.2.11-tuxcare.1, plus listed versions
3.2.11
3.2.11-tuxcare.1
Show 5 moreShow less
Affected packages
PackageAffectedFixed
vite
TuxCare:npm
From an advisory covering 16 CVEs
 4.1.5-tuxcare.0 up to 4.1.5-tuxcare.1, plus listed versions
4.1.5
4.1.5-tuxcare.1
vite
TuxCare:npm
 5.4.10-tuxcare.0 up to 5.4.10-tuxcare.2, plus listed versions
5.4.105.4.10-tuxcare.1
5.4.10-tuxcare.2
vite
TuxCare:npm
From an advisory covering 2 CVEs
 5.0.12-tuxcare.0 up to 5.0.12-tuxcare.4, plus listed versions
5.0.125.0.12-tuxcare.15.0.12-tuxcare.25.0.12-tuxcare.3
5.0.12-tuxcare.4
@vitejs/plugin-react
TuxCare:npm
From an advisory covering 11 CVEs
 2.9.18-tuxcare.0 up to 2.9.18-tuxcare.1, plus listed versions
2.9.18
2.9.18-tuxcare.1
@vitejs/plugin-react
TuxCare:npm
From an advisory covering 6 CVEs
 3.2.11-tuxcare.0 up to 3.2.11-tuxcare.1, plus listed versions
3.2.11
3.2.11-tuxcare.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubiSee857/CVE-2025-31486-PoC2025-04-07
PoC in GitHubll104567/CVE-2025-314862025-04-26
PoC in GitHubhackmelocal/CVE-2025-31486-Simulation2025-07-24
NucleiVite server.fs.deny Bypass - Local File Inclusion

History

History
RecordedChangedSources
affected
exploits, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-31486 is a medium vulnerability (CVSS 5.3) in Vitejs Vite, published April 3, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 40.5%, the 98th percentile. Fixed in vite 6.2.5.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open