CVE-2025-31125mediumunder attackCWE-200CWE-284

CVE-2025-31125: medium-severity vulnerability in vitejs vite

Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query

Published · Updated

Follow this CVE+ Monitor vite+ Monitor Vitejs

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 5.3epss 75%
from disclosure to weaponsame day
Published on NVDMar 31
1st PoCMar 26
CISA KEV+297d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
1 product (6 components)
Red Hat OpenShift distributed tracing 3
no_fix_planned: Out of support scope
Not affected
3 products (5 components) — because the vulnerable code is not present in the product
Red Hat Ansible Automation Platform 2 · Red Hat JBoss Enterprise Application Platform 8 · Red Hat JBoss Enterprise Application Platform Expansion Pack
Action required by CISAfederal deadline: 2026-02-12

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

Vite's file access restrictions can be bypassed using special query parameters (?inline&import or ?raw?import), allowing attackers to read files that should be protected. This only affects development servers intentionally exposed to the network.

Technical detail

A path traversal vulnerability in Vite's dev server bypasses server.fs.deny restrictions when ?inline&import or ?raw?import query parameters are appended to file requests. The attack requires network access to the exposed dev server and can result in unauthorized disclosure of sensitive files outside the intended accessible directory.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected products
vitejs · vite
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — vitejs vite

In the same product, most dangerous first.

CVE-2025-30208MEDIUMVite bypasses server.fs.deny when using `?raw??`EPSS 74.8%CVE-2025-31486MEDIUMVite allows server.fs.deny to be bypassed with .svg or relative pathsEPSS 40.5%CVE-2026-39363HIGHVite Affected by Arbitrary File Read via Vite Dev Server WebSocketEPSS 3.4%CVE-2023-34092HIGHVite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)EPSS 3.2%CVE-2026-39364HIGHVite has a `server.fs.deny` bypass with queriesEPSS 2.3%CVE-2025-32395MEDIUMVite has an `server.fs.deny` bypass with an invalid `request-target`EPSS 1.8%