CVE-2025-58752 — Relative Path Traversal in Vite

CWE-23 — Relative Path TraversalCWE-200 — Sensitive Information ExposureCWE-284 — Improper Access ControlCWE-22 — Path Traversal5 documents5 sources
Severity
2.3LOWNVD
EPSS
0.0%
top 95.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Vitejs Vite
Timeline
PublishedSep 8
Latest updateMar 12

Description

Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, any HTML files on the machine were served regardless of the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or server.host config option) and use `appType: 'spa'` (default) or `appType: 'mpa'` are affected. This vulnerability also affects the preview server. The preview server allowed HTML files not under the output directory to be served…

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Affected Packages3 packages

▶NVDvitejs/vite6.0.0 — 6.3.6+3
▶npmvitejs/vite7.1.0 — 7.1.5+3
▶CVEListV5vitejs/vite>= 6.0.0, < 6.3.6, >= 7.0.0, < 7.0.7, >= 7.1.0, < 7.1.5+2

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
Vite's `server.fs` settings were not applied to HTML files↗2025-09-09
▶
OSV
Vite's `server.fs` settings were not applied to HTML files↗2025-09-09
▶

📋Vendor Advisories

2
CISA ICS
Siemens SIDIS Prime↗2026-03-12
▶
Red Hat
vite: Vite's `server.fs` settings were not applied to HTML files↗2025-09-08
▶