CVE-2025-62522: medium-severity vulnerability in vitejs vite
vite allows server.fs.deny bypass via backslash on Windows
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 6epss 1.1%
Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows. Only apps explicitly exposing the Vite dev server to the network and running the dev server on Windows were affected. This issue has been patched in versions 5.4.21, 6.4.1, 7.0.8, and 7.1.11.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
vitejs · viteRelated CVEs — vitejs vite
In the same product, most dangerous first.
CVE-2025-31125MEDIUMVite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` queryEPSS 74.9%KEVCVE-2025-30208MEDIUMVite bypasses server.fs.deny when using `?raw??`EPSS 74.8%CVE-2025-31486MEDIUMVite allows server.fs.deny to be bypassed with .svg or relative pathsEPSS 40.5%CVE-2026-39363HIGHVite Affected by Arbitrary File Read via Vite Dev Server WebSocketEPSS 3.4%CVE-2023-34092HIGHVite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)EPSS 3.2%CVE-2026-39364HIGHVite has a `server.fs.deny` bypass with queriesEPSS 2.3%