CVEvulnerability

CVE-2025-58752

2.3 LOW Published 2025-09-08 Modified 2026-09-30 Official page ↗
Status
Analyzed
Published
2025-09-08
Last modified
2026-09-30
Assigner
[email protected]
CVSS 4.0 ([email protected])
2.3 LOW — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200, CWE-23, CWE-284

Description

Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, any HTML files on the machine were served regardless of the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or server.host config option) and use `appType: 'spa'` (default) or `appType: 'mpa'` are affected. This vulnerability also affects the preview server. The preview server allowed HTML files not under the output directory to be served. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.

Affected configurations

• vitejs vite (< 5.4.20) • vitejs vite (>= 6.0.0 < 6.3.6) • vitejs vite (>= 7.0.0 < 7.0.7) • vitejs vite (>= 7.1.0 < 7.1.5)

Related

Weakness · CWE (3)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-23 Relative Path Traversal weakness
  • CWE-284 Improper Access Control weakness

References