CVE-2025-31486
MEDIUM NUCLEIVite server.fs.deny Bypass - Local File Inclusion
Title source: nucleiExploitation Summary
EIP tracks 4 public exploits for CVE-2025-31486. PoCs published by Ly4j, iSee857, hackmelocal. A Nuclei detection template is also available.
AI-analyzed exploit summary This PoC exploits an arbitrary file read vulnerability in Vite SSR by crafting specific path traversal payloads to leak sensitive files like /etc/passwd or C:\windows\win.ini. It validates the leaked content using base64 decoding and pattern matching.
Description
Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5.
Exploits (4)
This PoC exploits an arbitrary file read vulnerability in Vite SSR by crafting specific path traversal payloads to leak sensitive files like /etc/passwd or C:\windows\win.ini. It validates the leaked content using base64 decoding and pattern matching.
This repository contains a Python-based scanner for CVE-2025-31486, a path traversal vulnerability in Vite.js. The script checks for the presence of the vulnerability by sending crafted requests to target URLs and analyzing responses for indicators of successful exploitation.
This repository provides a containerized lab environment to simulate and exploit CVE-2025-31486, a path traversal vulnerability in Vite's development server. The exploit allows reading arbitrary files by bypassing security checks via crafted URLs.
This PoC demonstrates an arbitrary file read vulnerability in Vite SSR by exploiting path traversal and improper input validation. It attempts to read sensitive files (e.g., /etc/passwd, C:\windows\win.ini) via crafted payloads and validates the response content.
Nuclei Templates (1)
title:"Vite App"
title="Vite App"
References (3)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N