Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

CVE-2025-31125

MEDIUM
Published 2025-03-31T17:06:30.704Z
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2025-31125. We'll provide specific mitigation strategies based on your environment and risk profile.

CVSS Score

V3.1
5.3
/10
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Base Score Metrics
Exploitability: N/A Impact: N/A

EPSS Score

v2025.03.14
0.108
probability
of exploitation in the wild

There is a 10.8% chance that this vulnerability will be exploited in the wild within the next 30 days.

Updated: 2025-06-25
Exploit Probability
Percentile: 0.930
Higher than 93.0% of all CVEs

Attack Vector Metrics

Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED

Impact Metrics

Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Description

Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.

Available Exploits

Vite Development Server - Path Traversal

Path traversal vulnerability in Vite development server's @fs endpoint allows attackers to access files outside the intended directory. When exposed to the network, attackers can exploit this via crafted URLs to access sensitive system files.

ID: CVE-2025-31125
Author: martianritikchaddhav2htw Medium

References:

Related News

No news articles found for this CVE.

Affected Products

vitejs

vite

Affected Versions:

>= 6.2.0, < 6.2.4 >= 6.1.0, < 6.1.3 >= 6.0.0, < 6.0.13 >= 5.0.0, < 5.4.16 < 4.5.11

EU Vulnerability Database

Monitored by ENISA for EU cybersecurity

EU Coordination

EU Coordinated

Exploitation Status

No Known Exploitation

EUVD ID

View on ENISA

ENISA Analysis

Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query

Affected Products (ENISA)

vitejs
vite

ENISA Scoring

CVSS Score (3.1)

5.3
/10
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS Score

8.330
probability

ENISA References

https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8
https://github.com/vitejs/vite/commit/59673137c45ac2bcfad1170d954347c1a17ab949
https://github.com/vitejs/vite
https://nvd.nist.gov/vuln/detail/CVE-2025-31125

Data provided by ENISA EU Vulnerability Database. Last updated: March 31, 2025

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

✓ GitHub Reviewed MODERATE

Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query

GHSA-4r4m-qw57-chr8

Advisory Details

### Summary The contents of arbitrary files can be returned to the browser. ### Impact Only apps explicitly exposing the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host)) are affected. ### Details - base64 encoded content of non-allowed files is exposed using `?inline&import` (originally reported as `?import&?inline=1.wasm?init`) - content of non-allowed files is exposed using `?raw?import` `/@fs/` isn't needed to reproduce the issue for files inside the project root. ### PoC Original report (check details above for simplified cases): The ?import&?inline=1.wasm?init ending allows attackers to read arbitrary files and returns the file content if it exists. Base64 decoding needs to be performed twice ``` $ npm create vite@latest $ cd vite-project/ $ npm install $ npm run dev ``` Example full URL `http://localhost:5173/@fs/C:/windows/win.ini?import&?inline=1.wasm?init`

Affected Packages

npm vite
ECOSYSTEM: ≥6.2.0 <6.2.4
npm vite
ECOSYSTEM: ≥6.1.0 <6.1.3
npm vite
ECOSYSTEM: ≥6.0.0 <6.0.13
npm vite
ECOSYSTEM: ≥5.0.0 <5.4.16
npm vite
ECOSYSTEM: ≥0 <4.5.11

CVSS Scoring

CVSS Score

5.0

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

References

WEB https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-31125
WEB https://github.com/vitejs/vite/commit/59673137c45ac2bcfad1170d954347c1a17ab949
PACKAGE https://github.com/vitejs/vite

Advisory provided by GitHub Security Advisory Database. Published: March 31, 2025, Modified: March 31, 2025

References

https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8
https://github.com/vitejs/vite/commit/59673137c45ac2bcfad1170d954347c1a17ab949
Published: 2025-03-31T17:06:30.704Z
Last Modified: 2025-03-31T17:59:26.675Z
Copied to clipboard!