CVE-2025-46565
Severity CVSS v4.0:
MEDIUM
Type:
CWE-22
Path Traversal
Publication date:
01/05/2025
Last modified:
02/10/2025
Description
Vite is a frontend tooling framework for javascript. Prior to versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. Only files that are under project root and are denied by a file matching pattern can be bypassed. `server.fs.deny` can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns). These patterns were able to bypass for files under `root` by using a combination of slash and dot (/.). This issue has been patched in versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14.
Impact
Base Score 4.0
6.00
Severity 4.0
MEDIUM
Base Score 3.x
5.30
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:* | 4.5.14 (excluding) | |
| cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:* | 5.0.0 (including) | 5.4.19 (excluding) |
| cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:* | 6.0.0 (including) | 6.1.6 (excluding) |
| cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:* | 6.2.0 (including) | 6.2.7 (excluding) |
| cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:* | 6.3.0 (including) | 6.3.4 (excluding) |
To consult the complete list of CPE names with products and versions, see this page