github.com
https://github.com/lukeed/sirv/commit/f0113f3f8266328d804ee808f763a3c11f8997eb CVE-2025-58751
LOWNuclei
Vite middleware may serve files starting with the same name with the public directory
Record summary
CVE-2025-58751 has a selected CVSS score of 2.3 (low); EIP currently links 1 Nuclei template.
Description
Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public directory were served bypassing the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or `server.host` config option), use the public directory feature (enabled by default), and have a symlink in the public directory are affected. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.
Description source: CVE List
Exploitation context
Available material
- Nuclei templates
- 1
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 9, 2025 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
| CVE List | < 5.4.20 | affected | |
| >= 6.0.0, < 6.3.6 | affected | ||
| >= 7.0.0, < 7.0.7 | affected | ||
| >= 7.1.0, < 7.1.5 | affected | ||
| GitHub Advisory | 7.1.0 to < 7.1.5 · Fixed in 7.1.5 | affected | |
| 7.0.0 to < 7.0.7 · Fixed in 7.0.7 | affected | ||
| 6.0.0 to < 6.3.6 · Fixed in 6.3.6 | affected | ||
| Before 5.4.20 · Fixed in 5.4.20 | affected |
Nuclei templates
1ProjectDiscoveryLOWVite Dev Server - Path TraversalCVSS 5.3
Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public directory were served bypassing the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or `server.host` config option), use the public directory feature (enabled by default), and have a symlink in the public directory are affected. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.
Impact
Attackers can access unauthorized files bypassing filesystem restrictions, potentially exposing sensitive data.
Remediation
Update to versions 7.1.5, 7.0.7, 6.3.6, or 5.4.20 or later.
WeaknessesCWE-22
Authorswn147
Template tagscvecve2025vitelfivuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
FOFA: body="/@vite/client"
https://github.com/vitejs/vite/security/advisories/GHSA-g4jq-h2w9-997c https://nvd.nist.gov/vuln/detail/CVE-2025-58751
Source: ProjectDiscovery
References
8github.com
https://github.com/vitejs/vite github.com
https://github.com/vitejs/vite/commit/09f2b52e8d5907f26602653caf41b3a56692600d github.com
https://github.com/vitejs/vite/commit/4f1c35bcbb5830290c694aa14b6789e07450f069 github.com
https://github.com/vitejs/vite/commit/63e2a5d232218f3f8d852056751e609a5367aaec github.com
https://github.com/vitejs/vite/commit/e11d24008b97d4ca731ecc1a3b95260a6d12e7e0 github.comConfirmation
https://github.com/vitejs/vite/security/advisories/GHSA-g4jq-h2w9-997c nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2025-58751