PT-2025-34242 · Vite · Vite-Plugin-Static-Copy

Ikkisoft · Published 2025-08-21 · Updated 2025-08-21 · CVE-2025-57753

Positive Technologies (AI Summary)

CVSS v4.0

6.0

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: vite-plugin-static-copy versions prior to 2.3.2 vite-plugin-static-copy versions prior to 3.1.2

Description: The vite-plugin-static-copy plugin for Vite allows access to files not included in the src directory through a crafted request. This can lead to the disclosure of arbitrary files on the filesystem. The vulnerability affects applications explicitly exposing the Vite dev server to the network. An attacker can exploit this issue by sending a specially crafted HTTP request to access files outside the intended directory.

Recommendations: vite-plugin-static-copy versions prior to 2.3.2: Update to version 2.3.2 or later. vite-plugin-static-copy versions prior to 3.1.2: Update to version 3.1.2 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-57753

GHSA-PP7P-Q8FX-2968

Affected Products

Vite-Plugin-Static-Copy

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/57xxx/CVE-2025-57753.json · Exploit
• 🔥 https://github.com/sapphi-red/vite-plugin-static-copy/security/advisories/GHSA-pp7p-q8fx-2968 · Exploit
• https://osv.dev/vulnerability/GHSA-pp7p-q8fx-2968 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-57753 · Security Note
• https://osv.dev/vulnerability/CVE-2025-57753 · Vendor Advisory
• https://github.com/sapphi-red/vite-plugin-static-copy/commit/0bc6b49ed72b46eecfc9682045f4b46a19694969 · Note
• https://github.com/sapphi-red/vite-plugin-static-copy/releases/tag/vite-plugin-static-copy%402.3.2 · Note
• https://github.com/sapphi-red/vite-plugin-static-copy/releases/tag/vite-plugin-static-copy%403.1.2 · Note
• https://github.com/sapphi-red/vite-plugin-static-copy · Note
• https://github.com/sapphi-red/vite-plugin-static-copy/commit/4627afb8582083eab733881d3d974e1c1f23997d · Note
• https://twitter.com/CVEnew/status/1958603393867686233 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1958657921710972979 · Twitter Post