PT-2025-38576 · Cloudflare · Cloudflared+2

Cherry · Published 2025-07-08 · Updated 2025-09-19 · CVE-2025-59427

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

Name of the Vulnerable Software and Affected Versions Cloudflare Vite plugin versions prior to 1.6.0

Description The Cloudflare Vite plugin, when used with its default configuration, exposes files from the root directory via the local development server. This includes sensitive files such as .env and .dev.vars which may contain secret information. If the development server is exposed on a public network, an attacker may be able to acquire these secrets. This can occur when using tools like wrangler or cloudflared without proper configuration. Exposed files may also include package.json and README.md, potentially revealing dependencies and internal documentation.

Recommendations Cloudflare Vite plugin versions prior to 1.6.0 should be updated to version 1.6.0 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-59427

GHSA-4PFG-2MW5-F8JX

Affected Products

@Cloudflare/Vite-Plugin

Cloudflared

Wrangler

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59427.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-59427 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59427 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4pfg-2mw5-f8jx · Vendor Advisory
• https://github.com/cloudflare/workers-sdk · Note
• https://github.com/cloudflare/workers-sdk/discussions/3455#discussioncomment-6165773 · Note
• https://github.com/cloudflare/workers-sdk/commit/0e500720bf70016fa4ea21fc8959c4bd764ebc38 · Note
• https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-4pfg-2mw5-f8jx · Note
• https://hackerone.com/reports/3117837 · Note
• https://t.me/CVEtracker/32959 · Telegram Post
• https://twitter.com/CVEnew/status/1969110852013080750 · Twitter Post