PT-2025-36528 · Vite · Vite

Orihjfrog · Published 2025-09-08 · Updated 2026-03-12 · CVE-2025-58751

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Vite versions prior to 7.1.5 Vite versions prior to 7.0.7 Vite versions prior to 6.3.6 Vite versions prior to 5.4.20

Description: Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name within the public directory could be served bypassing the server.fs settings. Only applications that explicitly expose the Vite dev server to the network (using --host or server.host config option), utilize the public directory feature (enabled by default), and contain a symlink in the public directory are affected.

Recommendations: Update to Vite version 7.1.5 or later. Update to Vite version 7.0.7 or later. Update to Vite version 6.3.6 or later. Update to Vite version 5.4.20 or later.

Exploit

Fix

Improper Access Control

Path traversal

Information Disclosure

Weakness Enumeration

CWE-284

CWE-22

CWE-200

Related Identifiers

CVE-2025-58751

GHSA-G4JQ-H2W9-997C

Affected Products

Vite

References · 16

• 🔥 https://github.com/vitejs/vite/security/advisories/GHSA-g4jq-h2w9-997c · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58751.json · Exploit
• https://github.com/vitejs/vite/commit/e11d24008b97d4ca731ecc1a3b95260a6d12e7e0 · Patch
• https://github.com/vitejs/vite/commit/09f2b52e8d5907f26602653caf41b3a56692600d · Patch
• https://github.com/vitejs/vite/commit/63e2a5d232218f3f8d852056751e609a5367aaec · Patch
• https://github.com/vitejs/vite/commit/4f1c35bcbb5830290c694aa14b6789e07450f069 · Patch
• https://github.com/lukeed/sirv/commit/f0113f3f8266328d804ee808f763a3c11f8997eb · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-58751 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2025-58751 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-58751 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g4jq-h2w9-997c · Vendor Advisory
• https://github.com/vitejs/vite · Note
• https://twitter.com/pdnuclei_bot/status/1977434121803858416 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1965231098910200311 · Twitter Post
• https://twitter.com/CVEnew/status/1965192289195585788 · Twitter Post