CVE-2025-46565

MEDIUMNuclei

Vite's server.fs.deny bypassed with /. for files under project root

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-46565 has a selected CVSS score of 6.0 (medium); EIP currently links 1 Nuclei template.

Description

Vite is a frontend tooling framework for javascript. Prior to versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. Only files that are under project root and are denied by a file matching pattern can be bypassed. `server.fs.deny` can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns). These patterns were able to bypass for files under `root` by using a combination of slash and dot (/.). This issue has been patched in versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated May 2, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

vite

Browse vitejs / vite
CVE List>= 6.3.0, < 6.3.4affected
>= 6.2.0, < 6.2.7affected
>= 6.0.0, < 6.1.6affected
>= 5.0.0, < 5.4.19affected
< 4.5.14affected

vite

Browse npm / vite
GitHub Advisory6.3.0 to < 6.3.4 · Fixed in 6.3.4affected
6.2.0 to < 6.2.7 · Fixed in 6.2.7affected
6.0.0 to < 6.1.6 · Fixed in 6.1.6affected
5.0.0 to < 5.4.19 · Fixed in 5.4.19affected
Before 4.5.14 · Fixed in 4.5.14affected

Nuclei templates

1
ProjectDiscoveryMEDIUMVite Dev Server - Information ExposureCVSS 5.3

Vite is a frontend tooling framework for JavaScript. Before versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. Only files that are under project root and are denied by a file matching pattern can be bypassed. `server.fs.deny` can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns). These patterns were able to bypass for files under `root` by using a combination of slash and dot (/.). This issue has been patched in versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14.

WeaknessesCWE-22
Authorsritikchaddha
Template tagscvecve2025viteexposurebypass
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Shodan: http.html:"/@vite/client"
FOFA: body="/@vite/client"
https://github.com/vitejs/vite/security/advisories/GHSA-859w-5945-r5v3 https://nvd.nist.gov/vuln/detail/CVE-2025-46565

Source: ProjectDiscovery

References

4