CVE-2025-58751
📋 TL;DR
This vulnerability in Vite allows attackers to bypass server.fs restrictions and access files outside the public directory when specific conditions are met. Only applications that expose the Vite dev server to the network, use the public directory feature, and have symlinks in the public directory are affected. The issue enables unauthorized file access but requires specific configuration.
💻 Affected Systems
- Vite
📦 What is this software?
Vite by Vitejs
Vite by Vitejs
Vite by Vitejs
Vite by Vitejs
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access sensitive files outside the public directory, potentially exposing source code, configuration files, or credentials stored in the project structure.
Likely Case
Limited file disclosure of project files adjacent to the public directory, potentially revealing development artifacts or configuration details.
If Mitigated
No impact if dev server is not exposed to network or if proper access controls restrict external connections.
🎯 Exploit Status
Exploitation requires knowledge of the target's file structure and specific conditions to be met. No public exploit code has been identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.1.5, 7.0.7, 6.3.6, or 5.4.20 depending on your major version
Vendor Advisory: https://github.com/vitejs/vite/security/advisories
Restart Required: Yes
Instructions:
1. Check current Vite version with 'npm list vite' or 'yarn list vite'. 2. Update to patched version: 'npm update vite@latest' or 'yarn upgrade vite@latest'. 3. Restart the Vite development server.
🔧 Temporary Workarounds
Disable network exposure
allDo not expose Vite dev server to network by avoiding --host flag and server.host configuration
Remove '--host' from dev script
Set server.host: false in vite.config.js
Remove symlinks from public directory
allEliminate symlinks in the public directory that could be exploited
find public/ -type l -delete
Remove any symlink references in public directory
🧯 If You Can't Patch
- Ensure Vite dev server is not exposed to external networks (use localhost only)
- Audit and remove all symlinks from the public directory
🔍 How to Verify
Check if Vulnerable:
Check if using vulnerable Vite version AND dev server is exposed to network AND public directory contains symlinksCheck Version:
npm list vite | grep vite or yarn list vite | grep viteVerify Fix Applied:
Confirm Vite version is 7.1.5+, 7.0.7+, 6.3.6+, or 5.4.20+ and test file access restrictions📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns from external IPs to Vite dev server
- Requests for files outside expected public directory paths
Network Indicators:
- External connections to Vite dev server port (typically 5173) with file path traversal patterns
SIEM Query:
source="vite-logs" AND (dst_port=5173 OR dst_port=3000) AND (uri CONTAINS "../" OR uri CONTAINS "symlink")🔗 References
- https://github.com/lukeed/sirv/commit/f0113f3f8266328d804ee808f763a3c11f8997eb
- https://github.com/vitejs/vite/commit/09f2b52e8d5907f26602653caf41b3a56692600d
- https://github.com/vitejs/vite/commit/4f1c35bcbb5830290c694aa14b6789e07450f069
- https://github.com/vitejs/vite/commit/63e2a5d232218f3f8d852056751e609a5367aaec
- https://github.com/vitejs/vite/commit/e11d24008b97d4ca731ecc1a3b95260a6d12e7e0
- https://github.com/vitejs/vite/security/advisories/GHSA-g4jq-h2w9-997c
- https://github.com/vitejs/vite/security/advisories/GHSA-g4jq-h2w9-997c
