CVE-2025-62522

MEDIUM NUCLEI

Vite 2.9.18-2.9.x 3.2.9-3.x 4.5.3-4.x 5.2.6-5.4.20 6.0.0-6.4.0 7.0.0-7.0.7 7.1.0-7.1.10 Path Traversal

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2025-62522 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows. Only apps explicitly exposing the Vite dev server to the network and running the dev server on Windows were affected. This issue has been patched in versions 5.4.21, 6.4.1, 7.0.8, and 7.1.11.

Nuclei Templates (1)

Vite - Information Disclosure
MEDIUMVERIFIEDby DhiyaneshDK
FOFA: body="/@vite/client"

References (2)

Core 2

Scores

CVSS v4 6.0
EPSS 0.0082
EPSS Percentile 74.9%
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-22
Status published
Products (8)
npm/vite 7.1.0 - 7.1.11npm
vitejs/vite >= 2.9.18, < 3.0.0
vitejs/vite >= 3.2.9, < 4.0.0
vitejs/vite >= 4.5.3, < 5.0.0
vitejs/vite >= 5.2.6, < 5.4.21
vitejs/vite >= 6.0.0, < 6.4.1
vitejs/vite >= 7.0.0, < 7.0.8
vitejs/vite >= 7.1.0, < 7.1.11
Published Oct 20, 2025
Tracked Since Feb 18, 2026