PT-2025-36529 · Vite · Vite

Orihjfrog · Published 2025-09-08 · Updated 2026-03-12 · CVE-2025-58752

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Vite versions prior to 7.1.5 Vite versions prior to 7.0.7 Vite versions prior to 6.3.6 Vite versions prior to 5.4.20

Description: Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, any HTML files on the machine were served regardless of the server.fs settings. Only applications that explicitly expose the Vite dev server to the network (using --host or server.host config option) and use appType: 'spa' (default) or appType: 'mpa' are affected. This issue also affects the preview server, which allowed HTML files not under the output directory to be served.

Recommendations: Update to Vite version 7.1.5 or later. Update to Vite version 7.0.7 or later. Update to Vite version 6.3.6 or later. Update to Vite version 5.4.20 or later.

Exploit

Fix

Improper Access Control

Relative Path Traversal

Information Disclosure

Weakness Enumeration

CWE-284

CWE-23

CWE-200

Related Identifiers

CVE-2025-58752

GHSA-JQFW-VQ24-V9C3

Affected Products

Vite

References · 14

• 🔥 https://github.com/vitejs/vite/security/advisories/GHSA-jqfw-vq24-v9c3 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58752.json · Exploit
• https://github.com/vitejs/vite/commit/0ab19ea9fcb66f544328f442cf6e70f7c0528d5f · Patch
• https://github.com/vitejs/vite/commit/482000f57f56fe6ff2e905305100cfe03043ddea · Patch
• https://github.com/vitejs/vite/commit/14015d794f69accba68798bd0e15135bc51c9c1e · Patch
• https://github.com/vitejs/vite/commit/6f01ff4fe072bcfcd4e2a84811772b818cd51fe6 · Patch
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2025-58752 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jqfw-vq24-v9c3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58752 · Security Note
• https://osv.dev/vulnerability/CVE-2025-58752 · Vendor Advisory
• https://github.com/vitejs/vite · Note
• https://github.com/vitejs/vite/blob/v7.1.5/packages/vite/CHANGELOG.md · Note
• https://twitter.com/CVEnew/status/1965192287882817585 · Twitter Post
• https://t.me/CVEtracker/32006 · Telegram Post