CVE-2025-58752
BaseFortify
Publication date: 2025-09-08
Last updated on: 2025-09-17
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| vitejs | vite | to 5.4.20 (exc) |
| vitejs | vite | From 6.0.0 (inc) to 6.3.6 (exc) |
| vitejs | vite | From 7.0.0 (inc) to 7.0.7 (exc) |
| vitejs | vite | From 7.1.0 (inc) to 7.1.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-23 | The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory. |
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Vite, a frontend tooling framework for JavaScript, allows any HTML files on the machine to be served regardless of the configured server file system (server.fs) settings. It affects apps that expose the Vite dev server to the network and use the default or specified app types ('spa' or 'mpa'). The preview server is also affected, as it allowed serving HTML files outside the designated output directory. This issue was fixed in versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20.
How can this vulnerability impact me? :
This vulnerability can lead to unintended exposure of HTML files on the machine, potentially leaking sensitive or private information by serving files that should be restricted. This could allow unauthorized users to access files outside the intended directories when the Vite dev or preview server is exposed to the network.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade Vite to version 7.1.5, 7.0.7, 6.3.6, or 5.4.20 or later. Additionally, avoid exposing the Vite dev server to the network unless necessary, and review your server.fs settings and appType configurations to ensure they are correctly set to prevent serving unintended HTML files.