{"id":"CVE-2025-31486","aliases":["CLSA-2026-1775089661","CLSA-2026-1775176118","CLSA-2026-1777509608","CLSA-2026-1777509610","CLSA-2026-1789031855","CLSA-2026-1791666893","CLSA-2026-1791795546","CLSA-2026-1792225950","CLSA-2026-1792225952","EUVD-2025-9734","GHSA-4w7w-66w2-5vf9","GHSA-xcj6-pq6g-qj4x"],"status":"published","title":"Vite allows server.fs.deny to be bypassed with .svg or relative paths","description":"Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.40461,"percentile":0.98658,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-200","CWE-284"],"published":"2025-04-03T18:24:39Z","modified":"2026-11-04T10:45:24Z","exploits":[{"source":"pocgithub","id":"iSee857/CVE-2025-31486-PoC","title":"iSee857/CVE-2025-31486-PoC","date":"2025-04-07","url":"https://github.com/iSee857/CVE-2025-31486-PoC"},{"source":"pocgithub","id":"ll104567/CVE-2025-31486","title":"ll104567/CVE-2025-31486","date":"2025-04-26","url":"https://github.com/ll104567/CVE-2025-31486"},{"source":"pocgithub","id":"hackmelocal/CVE-2025-31486-Simulation","title":"hackmelocal/CVE-2025-31486-Simulation","date":"2025-07-24","url":"https://github.com/hackmelocal/CVE-2025-31486-Simulation"},{"source":"nuclei","id":"CVE-2025-31486","title":"Vite server.fs.deny Bypass - Local File Inclusion","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-31486.yaml"}],"fixes":[{"ecosystem":"npm","package":"vite","fixed_in":["6.2.5","6.1.4","6.0.14","5.4.17","4.5.12"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"vite","fixed_in":["5.4.10-tuxcare.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.2.5"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.0"},{"fixed":"6.1.4"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.14"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.4.17"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.12"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@vitejs/plugin-legacy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.14-tuxcare.0"},{"fixed":"5.4.14-tuxcare.1"}]}],"versions":["5.4.14"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.14-tuxcare.0"},{"fixed":"5.4.14-tuxcare.1"}]}],"versions":["5.4.14"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.5-tuxcare.0"},{"fixed":"4.5.5-tuxcare.1"}]}],"versions":["4.5.5"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.18-tuxcare.0"},{"fixed":"2.9.18-tuxcare.1"}]}],"versions":["2.9.18"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.11-tuxcare.0"},{"fixed":"3.2.11-tuxcare.1"}]}],"versions":["3.2.11"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.5-tuxcare.0"},{"fixed":"4.1.5-tuxcare.1"}]}],"versions":["4.1.5"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.10-tuxcare.0"},{"fixed":"5.4.10-tuxcare.2"}]}],"versions":["5.4.10","5.4.10-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.12-tuxcare.0"},{"fixed":"5.0.12-tuxcare.4"}]}],"versions":["5.0.12","5.0.12-tuxcare.1","5.0.12-tuxcare.2","5.0.12-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"@vitejs/plugin-react","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.18-tuxcare.0"},{"fixed":"2.9.18-tuxcare.1"}]}],"versions":["2.9.18"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"@vitejs/plugin-react","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.11-tuxcare.0"},{"fixed":"3.2.11-tuxcare.1"}]}],"versions":["3.2.11"],"bundled":6},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"6.2.0"},{"fixed":"6.2.5"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"6.1.0"},{"fixed":"6.1.4"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"6.0.0"},{"fixed":"6.0.14"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"5.4.17"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.5.12"}]}]}],"products":[{"vendor":"vitejs","product":"vite"}],"references":[{"url":"https://github.com/vitejs/vite/security/advisories/GHSA-xcj6-pq6g-qj4x","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/vitejs/vite/commit/62d7e81ee189d65899bb65f3263ddbd85247b647","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-31486","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xcj6-pq6g-qj4x"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31486.json","tags":["advisory"]},{"url":"https://github.com/vitejs/vite","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-31486","title":"Vite allows server.fs.deny to be bypassed with .svg or relative paths","description":"Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5.","status":"published","published":"2025-04-03T18:24:39.616Z","modified":"2025-04-03T20:39:28.939Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200","CWE-284"],"updated_at":"2026-11-02T14:32:44.763463Z"}],"euvd":[{"id":"EUVD-2025-9734","description":"Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5.","status":"published","published":"2025-04-03T18:24:39Z","modified":"2025-04-03T20:39:28Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:42.939917Z"}],"ghsa":[{"id":"GHSA-xcj6-pq6g-qj4x","title":"Vite allows server.fs.deny to be bypassed with .svg or relative paths","description":"### Summary\n\nThe contents of arbitrary files can be returned to the browser.\n\n### Impact\n\nOnly apps explicitly exposing the Vite dev server to the network (using --host or [server.host config option](https://vitejs.dev/config/server-options.html#server-host)) are affected.\n\n### Details\n\n#### `.svg`\n\nRequests ending with `.svg` are loaded at this line.\nhttps://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290\nBy adding `?.svg` with `?.wasm?init` or with `sec-fetch-dest: script` header, the restriction was able to bypass.\n\nThis bypass is only possible if the file is smaller than [`build.assetsInlineLimit`](https://vite.dev/config/build-options.html#build-assetsinlinelimit) (default: 4kB) and when using Vite 6.0+.\n\n#### relative paths\n\nThe check was applied before the id normalization. This allowed requests to bypass with relative paths (e.g. `../../`).\n\n### PoC\n\n```bash\nnpm create vite@latest\ncd vite-project/\nnpm install\nnpm run dev\n```\n\nsend request to read `etc/passwd`\n\n```bash\ncurl 'http://127.0.0.1:5173/etc/passwd?.svg?.wasm?init'\n```\n\n```bash\ncurl 'http://127.0.0.1:5173/@fs/x/x/x/vite-project/?/../../../../../etc/passwd?import\u0026?raw'\n```","status":"published","published":"2025-04-04T14:20:05Z","modified":"2025-04-30T17:26:54Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-284"],"updated_at":"2026-11-02T14:38:41.402125Z"}],"nvd":[{"id":"CVE-2025-31486","description":"Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5.","status":"published","published":"2025-04-03T19:15:39.89Z","modified":"2026-06-17T09:10:29.17Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-200","CWE-284"],"updated_at":"2026-11-02T14:10:58.094557Z"}],"osv":[{"id":"CVE-2025-31486","title":"Vite allows server.fs.deny to be bypassed with .svg or relative paths","description":"Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5.","status":"published","published":"2025-04-03T18:24:39.616Z","modified":"2026-11-04T10:45:24.271524137Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-284"],"updated_at":"2026-11-04T11:07:20.833685Z"},{"id":"GHSA-xcj6-pq6g-qj4x","title":"Vite allows server.fs.deny to be bypassed with .svg or relative paths","description":"### Summary\n\nThe contents of arbitrary files can be returned to the browser.\n\n### Impact\n\nOnly apps explicitly exposing the Vite dev server to the network (using --host or [server.host config option](https://vitejs.dev/config/server-options.html#server-host)) are affected.\n\n### Details\n\n#### `.svg`\n\nRequests ending with `.svg` are loaded at this line.\nhttps://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290\nBy adding `?.svg` with `?.wasm?init` or with `sec-fetch-dest: script` header, the restriction was able to bypass.\n\nThis bypass is only possible if the file is smaller than [`build.assetsInlineLimit`](https://vite.dev/config/build-options.html#build-assetsinlinelimit) (default: 4kB) and when using Vite 6.0+.\n\n#### relative paths\n\nThe check was applied before the id normalization. This allowed requests to bypass with relative paths (e.g. `../../`).\n\n### PoC\n\n```bash\nnpm create vite@latest\ncd vite-project/\nnpm install\nnpm run dev\n```\n\nsend request to read `etc/passwd`\n\n```bash\ncurl 'http://127.0.0.1:5173/etc/passwd?.svg?.wasm?init'\n```\n\n```bash\ncurl 'http://127.0.0.1:5173/@fs/x/x/x/vite-project/?/../../../../../etc/passwd?import\u0026?raw'\n```","status":"published","published":"2025-04-04T14:20:05Z","modified":"2026-09-10T03:49:36.567949213Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-284"],"updated_at":"2026-11-02T15:46:59.835583Z"},{"id":"CLSA-2026-1775089661","title":"TuxCare security update for 2 packages (5 CVEs)","description":"TuxCare rebuilt 2 packages to address 5 CVEs. Fixed in 5.4.14-tuxcare.1.","status":"published","published":"2026-08-04T14:52:20Z","modified":"2026-10-15T09:47:49.386394056Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1775176118","title":"TuxCare security update for vite (6 CVEs)","description":"TuxCare rebuilt vite to address 6 CVEs. Fixed in 4.5.5-tuxcare.1.","status":"published","published":"2026-08-04T14:52:20Z","modified":"2026-10-29T19:45:49.047753795Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1777509608","title":"TuxCare security update for vite (11 CVEs)","description":"TuxCare rebuilt vite to address 11 CVEs. Fixed in 2.9.18-tuxcare.1.","status":"published","published":"2026-08-04T14:52:29Z","modified":"2026-10-29T19:45:49.027696506Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777509610","title":"TuxCare security update for vite (6 CVEs)","description":"TuxCare rebuilt vite to address 6 CVEs. Fixed in 3.2.11-tuxcare.1.","status":"published","published":"2026-08-04T14:52:29Z","modified":"2026-10-29T19:45:48.668881699Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1789031855","title":"TuxCare security update for vite (16 CVEs)","description":"TuxCare rebuilt vite to address 16 CVEs. Fixed in 4.1.5-tuxcare.1.","status":"published","published":"2026-09-10T09:17:35Z","modified":"2026-10-15T09:47:55.69239765Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1791666893","title":"TuxCare security update for vite (1 CVE)","description":"TuxCare rebuilt vite to address 1 CVE. Fixed in 5.4.10-tuxcare.2.","status":"published","published":"2026-10-10T21:14:53Z","modified":"2026-10-15T09:45:40.495722865Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791795546","title":"TuxCare security update for vite (2 CVEs)","description":"TuxCare rebuilt vite to address 2 CVEs. Fixed in 5.0.12-tuxcare.4.","status":"published","published":"2026-10-12T08:59:06Z","modified":"2026-10-15T09:47:39.913863975Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792225950","title":"TuxCare security update for @vitejs/plugin-react (11 CVEs)","description":"TuxCare rebuilt @vitejs/plugin-react to address 11 CVEs. Fixed in 2.9.18-tuxcare.1.","status":"published","published":"2026-10-17T08:32:30Z","modified":"2026-10-17T13:09:25.089676995Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792225952","title":"TuxCare security update for @vitejs/plugin-react (6 CVEs)","description":"TuxCare rebuilt @vitejs/plugin-react to address 6 CVEs. Fixed in 3.2.11-tuxcare.1.","status":"published","published":"2026-10-17T08:32:31Z","modified":"2026-10-17T13:09:24.527313649Z","updated_at":"2026-11-02T15:43:52.011757Z"}]}}