Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2025-31486 — Sensitive Information Exposure in Vite

CWE-200 — Sensitive Information ExposureCWE-284 — Improper Access ControlCWE-295 — Improper Certificate Validation7 documents7 sources
Severity
5.3MEDIUMNVD
EPSS
2.5%
top 14.73%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
8
Vitejs ViteMsrc Cbl2 Perl 5.34.1-489 ON CBL Mariner 2.0Msrc Cbl2 Perl 5.34.1-490 ON CBL Mariner 2.0+5 more
Timeline
PublishedApr 3
Latest updateApr 9

Description

Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerabil…

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 1.6 | Impact: 3.6

Affected Packages9 packages

▶CVEListV5vitejs/vite< 4.5.12+4
▶npmvitejs/vite6.2.0 — 6.2.5+4

🔴Vulnerability Details

2
GHSA
Vite allows server.fs.deny to be bypassed with .svg or relative paths↗2025-04-04
▶
OSV
Vite allows server.fs.deny to be bypassed with .svg or relative paths↗2025-04-04
▶

💥Exploits & PoCs

1
Nuclei
Vite server.fs.deny Bypass - Local File Inclusion
▶

🔍Detection Rules

1
Suricata
ET WEB_SPECIFIC_APPS Vite Unauthenticated Arbitrary File Read (CVE-2025-31486)↗2025-04-09
▶

📋Vendor Advisories

2
Red Hat
vite: Vite allows server.fs.deny to be bypassed with .svg or relative paths↗2025-04-03
▶
Microsoft
HTTP::Tiny before 0.083 a Perl core module since 5.13.9 and available standalone on CPAN has an insecure default TLS configuration where users must opt in to verify certificates.↗2023-04-11
▶