CVE-2025-62522

MEDIUMNuclei

vite allows server.fs.deny bypass via backslash on Windows

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-62522 has a selected CVSS score of 6.0 (medium); EIP currently links 1 Nuclei template.

Description

Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows. Only apps explicitly exposing the Vite dev server to the network and running the dev server on Windows were affected. This issue has been patched in versions 5.4.21, 6.4.1, 7.0.8, and 7.1.11.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 20, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

vite

Browse vitejs / vite
CVE List>= 7.1.0, < 7.1.11affected
>= 7.0.0, < 7.0.8affected
>= 6.0.0, < 6.4.1affected
>= 5.2.6, < 5.4.21affected
>= 4.5.3, < 5.0.0affected
>= 3.2.9, < 4.0.0affected
>= 2.9.18, < 3.0.0affected

vite

Browse npm / vite
GitHub Advisory7.1.0 to < 7.1.11 · Fixed in 7.1.11affected
7.0.0 to < 7.0.8 · Fixed in 7.0.8affected
6.0.0 to < 6.4.1 · Fixed in 6.4.1affected
2.9.18 to < 5.4.21 · Fixed in 5.4.21affected
3.2.9 to < 5.4.21 · Fixed in 5.4.21affected
4.5.3 to < 5.4.21 · Fixed in 5.4.21affected
5.2.6 to < 5.4.21 · Fixed in 5.4.21affected

Nuclei templates

1
ProjectDiscoveryMEDIUMVite - Information Disclosure

Vite is a frontend tooling framework for JavaScript.In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows. Only apps explicitly exposing the Vite dev server to the network and running the dev server on Windows were affected. This issue has been patched in versions 5.4.21, 6.4.1, 7.0.8, and 7.1.11.

Impact

Remote attackers can access files denied by server.fs.deny, leading to sensitive information disclosure.

Remediation

Update to versions 5.4.21, 6.4.1, 7.0.8, or 7.1.11 or later.

AuthorsDhiyaneshDK
Template tagscvecve2025envvitedisclosure
FOFA: body="/@vite/client"
https://github.com/vitejs/vite/security/advisories/GHSA-93m4-6634-74q7

Source: ProjectDiscovery

References

4