PT-2025-18682 · Vite · Vite

Chienhm

·

Published

2025-04-30

·

Updated

2026-03-27

·

CVE-2025-46565

CVSS v4.0

6.0

Medium

VectorAV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions Vite versions prior to 6.3.4 Vite versions prior to 6.2.7 Vite versions prior to 6.1.6 Vite versions prior to 5.4.19 Vite versions prior to 4.5.14
Description The issue concerns Vite, a frontend tooling framework for JavaScript. In affected versions, the contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Only applications that explicitly expose the Vite dev server to the network are affected. The server.fs.deny configuration can contain patterns matching against files, such as .env, .env.*, and *.{crt,pem}. These patterns can be bypassed for files under the project root using a combination of slash and dot (/.).
Recommendations To resolve the issue, update to version 6.3.4 or later. To resolve the issue, update to version 6.2.7 or later. To resolve the issue, update to version 6.1.6 or later. To resolve the issue, update to version 5.4.19 or later. To resolve the issue, update to version 4.5.14 or later.

Exploit

Fix

DoS

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-46565
GHSA-859W-5945-R5V3

Affected Products

Vite