CVE-2025-58751

MEDIUM NUCLEI

Vite <7.1.5, <7.0.7, <6.3.6, <5.4.20 - Auth Bypass

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2025-58751 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public directory were served bypassing the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or `server.host` config option), use the public directory feature (enabled by default), and have a symlink in the public directory are affected. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.

Nuclei Templates (1)

Vite Dev Server - Path Traversal
LOWVERIFIEDby wn147
FOFA: body="/@vite/client"

References (6)

Core 6

Scores

CVSS v3 5.3
EPSS 0.0143
EPSS Percentile 81.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-22 CWE-284 CWE-200
Status published
Products (2)
npm/vite 7.1.0 - 7.1.5npm
vitejs/vite < 5.4.20
Published Sep 08, 2025
Tracked Since Feb 18, 2026