{"id":"CVE-2025-31125","aliases":["CLSA-2026-1775176118","CLSA-2026-1777249675","CLSA-2026-1777509608","CLSA-2026-1777509610","CLSA-2026-1789031855","CLSA-2026-1790801785","CLSA-2026-1790803771","CLSA-2026-1790804788","CLSA-2026-1792225950","CLSA-2026-1792225952","EUVD-2025-8866","GHSA-4r4m-qw57-chr8"],"status":"published","title":"Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query","description":"Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline\u0026import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.74939,"percentile":0.99512,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-200","CWE-284"],"published":"2025-03-31T17:06:30Z","modified":"2026-11-04T10:45:24Z","kev":{"date_added":"2026-01-22","due_date":"2026-02-12","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2026-01-22"},{"source":"kev","since":"2026-01-22"}],"exploits":[{"source":"pocgithub","id":"sunhuiHi666/CVE-2025-31125","title":"sunhuiHi666/CVE-2025-31125","date":"2025-04-01","url":"https://github.com/sunhuiHi666/CVE-2025-31125"},{"source":"pocgithub","id":"MuhammadWaseem29/Vitejs-exploit","title":"MuhammadWaseem29/Vitejs-exploit","date":"2025-05-03","url":"https://github.com/MuhammadWaseem29/Vitejs-exploit"},{"source":"pocgithub","id":"0xgh057r3c0n/CVE-2025-31125","title":"0xgh057r3c0n/CVE-2025-31125","date":"2025-05-07","url":"https://github.com/0xgh057r3c0n/CVE-2025-31125"},{"source":"pocgithub","id":"harshgupptaa/Path-Transversal-CVE-2025-31125-","title":"harshgupptaa/Path-Transversal-CVE-2025-31125-","date":"2025-07-13","url":"https://github.com/harshgupptaa/Path-Transversal-CVE-2025-31125-"},{"source":"nuclei","id":"CVE-2025-31125","title":"Vite Development Server - Path Traversal","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-31125.yaml"}],"fixes":[{"ecosystem":"npm","package":"vite","fixed_in":["6.2.4","6.1.3","6.0.13","5.4.16","4.5.11"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.2.4"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.0"},{"fixed":"6.1.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.13"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.4.16"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.11"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.5-tuxcare.0"},{"fixed":"4.5.5-tuxcare.1"}]}],"versions":["4.5.5"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.14-tuxcare.0"},{"fixed":"5.4.14-tuxcare.2"}]}],"versions":["5.4.14","5.4.14-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.18-tuxcare.0"},{"fixed":"2.9.18-tuxcare.1"}]}],"versions":["2.9.18"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.11-tuxcare.0"},{"fixed":"3.2.11-tuxcare.1"}]}],"versions":["3.2.11"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.5-tuxcare.0"},{"fixed":"4.1.5-tuxcare.1"}]}],"versions":["4.1.5"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.12-tuxcare.0"},{"fixed":"5.0.12-tuxcare.1"}]}],"versions":["5.0.12"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0-tuxcare.0"},{"fixed":"4.5.0-tuxcare.1"}]}],"versions":["4.5.0"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.10-tuxcare.0"},{"fixed":"5.4.10-tuxcare.1"}]}],"versions":["5.4.10"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@vitejs/plugin-react","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.18-tuxcare.0"},{"fixed":"2.9.18-tuxcare.1"}]}],"versions":["2.9.18"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"@vitejs/plugin-react","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.11-tuxcare.0"},{"fixed":"3.2.11-tuxcare.1"}]}],"versions":["3.2.11"],"bundled":6},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"6.2.0"},{"fixed":"6.2.4"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"6.1.0"},{"fixed":"6.1.3"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"6.0.0"},{"fixed":"6.0.13"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"5.4.16"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.5.11"}]}]}],"products":[{"vendor":"vite","product":"vitejs"},{"vendor":"vitejs","product":"vite"}],"references":[{"url":"https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/vitejs/vite/commit/59673137c45ac2bcfad1170d954347c1a17ab949","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31125","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-31125","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4r4m-qw57-chr8"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31125.json","tags":["advisory"]},{"url":"https://github.com/vitejs/vite","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-31125","title":"Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query","description":"Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline\u0026import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.","status":"published","published":"2025-03-31T17:06:30.704Z","modified":"2026-01-23T16:58:37.048Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200","CWE-284"],"updated_at":"2026-11-02T14:32:44.424933Z"}],"euvd":[{"id":"EUVD-2025-8866","description":"Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline\u0026import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.","status":"published","published":"2025-03-31T17:06:30Z","modified":"2026-01-23T16:58:37Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"exploited_since":"2026-01-22","updated_at":"2026-11-02T19:48:48.084617Z"}],"ghsa":[{"id":"GHSA-4r4m-qw57-chr8","title":"Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query","description":"### Summary\n\nThe contents of arbitrary files can be returned to the browser.\n\n### Impact\nOnly apps explicitly exposing the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host)) are affected.\n\n### Details\n\n- base64 encoded content of non-allowed files is exposed using `?inline\u0026import` (originally reported as `?import\u0026?inline=1.wasm?init`)\n- content of non-allowed files is exposed using `?raw?import`\n\n`/@fs/` isn't needed to reproduce the issue for files inside the project root.\n\n### PoC\n\nOriginal report (check details above for simplified cases):\n\nThe ?import\u0026?inline=1.wasm?init ending allows attackers to read arbitrary files and returns the file content if it exists.  Base64 decoding needs to be performed twice\n```\n$ npm create vite@latest\n$ cd vite-project/\n$ npm install\n$ npm run dev\n```\n\nExample full URL `http://localhost:5173/@fs/C:/windows/win.ini?import\u0026?inline=1.wasm?init`","status":"published","published":"2025-03-31T17:31:54Z","modified":"2026-01-22T21:47:41Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-284"],"updated_at":"2026-11-02T14:39:19.525691Z"}],"kev":[{"id":"CVE-2025-31125","title":"Vite Vitejs Improper Access Control Vulnerability","description":"Vite Vitejs contains an improper access control vulnerability that exposes content of non-allowed files using ?inline\u0026import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.","cwes":["CWE-200","CWE-284"],"kev":{"date_added":"2026-01-22","due_date":"2026-02-12","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:15.999436Z"}],"nvd":[{"id":"CVE-2025-31125","description":"Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline\u0026import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.","status":"published","published":"2025-03-31T17:15:43.163Z","modified":"2026-06-17T09:09:54.04Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-200","CWE-284"],"updated_at":"2026-11-02T14:10:56.494516Z"}],"osv":[{"id":"CVE-2025-31125","title":"Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query","description":"Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline\u0026import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.","status":"published","published":"2025-03-31T17:06:30.704Z","modified":"2026-11-04T10:45:24.603864661Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-284"],"updated_at":"2026-11-04T11:07:20.833685Z"},{"id":"GHSA-4r4m-qw57-chr8","title":"Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query","description":"### Summary\n\nThe contents of arbitrary files can be returned to the browser.\n\n### Impact\nOnly apps explicitly exposing the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host)) are affected.\n\n### Details\n\n- base64 encoded content of non-allowed files is exposed using `?inline\u0026import` (originally reported as `?import\u0026?inline=1.wasm?init`)\n- content of non-allowed files is exposed using `?raw?import`\n\n`/@fs/` isn't needed to reproduce the issue for files inside the project root.\n\n### PoC\n\nOriginal report (check details above for simplified cases):\n\nThe ?import\u0026?inline=1.wasm?init ending allows attackers to read arbitrary files and returns the file content if it exists.  Base64 decoding needs to be performed twice\n```\n$ npm create vite@latest\n$ cd vite-project/\n$ npm install\n$ npm run dev\n```\n\nExample full URL `http://localhost:5173/@fs/C:/windows/win.ini?import\u0026?inline=1.wasm?init`","status":"published","published":"2025-03-31T17:31:54Z","modified":"2026-09-10T03:50:56.858424937Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-284"],"updated_at":"2026-11-02T15:46:37.528068Z"},{"id":"CLSA-2026-1775176118","title":"TuxCare security update for vite (6 CVEs)","description":"TuxCare rebuilt vite to address 6 CVEs. Fixed in 4.5.5-tuxcare.1.","status":"published","published":"2026-08-04T14:52:20Z","modified":"2026-10-29T19:45:49.047753795Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1777249675","title":"TuxCare security update for vite (4 CVEs)","description":"TuxCare rebuilt vite to address 4 CVEs. Fixed in 5.4.14-tuxcare.2.","status":"published","published":"2026-08-04T14:52:20Z","modified":"2026-10-29T19:45:49.018347409Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777509608","title":"TuxCare security update for vite (11 CVEs)","description":"TuxCare rebuilt vite to address 11 CVEs. Fixed in 2.9.18-tuxcare.1.","status":"published","published":"2026-08-04T14:52:29Z","modified":"2026-10-29T19:45:49.027696506Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777509610","title":"TuxCare security update for vite (6 CVEs)","description":"TuxCare rebuilt vite to address 6 CVEs. Fixed in 3.2.11-tuxcare.1.","status":"published","published":"2026-08-04T14:52:29Z","modified":"2026-10-29T19:45:48.668881699Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1789031855","title":"TuxCare security update for vite (16 CVEs)","description":"TuxCare rebuilt vite to address 16 CVEs. Fixed in 4.1.5-tuxcare.1.","status":"published","published":"2026-09-10T09:17:35Z","modified":"2026-10-15T09:47:55.69239765Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1790801785","title":"TuxCare security update for vite (3 CVEs)","description":"TuxCare rebuilt vite to address 3 CVEs. Fixed in 5.0.12-tuxcare.1.","status":"published","published":"2026-09-30T20:56:25Z","modified":"2026-10-15T09:47:41.931265189Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790803771","title":"TuxCare security update for vite (3 CVEs)","description":"TuxCare rebuilt vite to address 3 CVEs. Fixed in 4.5.0-tuxcare.1.","status":"published","published":"2026-09-30T21:29:31Z","modified":"2026-10-15T09:47:41.932696368Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790804788","title":"TuxCare security update for vite (2 CVEs)","description":"TuxCare rebuilt vite to address 2 CVEs. Fixed in 5.4.10-tuxcare.1.","status":"published","published":"2026-09-30T21:46:28Z","modified":"2026-10-15T09:47:42.023166804Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1792225950","title":"TuxCare security update for @vitejs/plugin-react (11 CVEs)","description":"TuxCare rebuilt @vitejs/plugin-react to address 11 CVEs. Fixed in 2.9.18-tuxcare.1.","status":"published","published":"2026-10-17T08:32:30Z","modified":"2026-10-17T13:09:25.089676995Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792225952","title":"TuxCare security update for @vitejs/plugin-react (6 CVEs)","description":"TuxCare rebuilt @vitejs/plugin-react to address 6 CVEs. Fixed in 3.2.11-tuxcare.1.","status":"published","published":"2026-10-17T08:32:31Z","modified":"2026-10-17T13:09:24.527313649Z","updated_at":"2026-11-02T15:43:52.011757Z"}]}}