Vulnerability · Published Oct 20, 2025 · Assigned by GitHub_M

CVE-2025-62522vite allows server.fs.deny bypass via backslash on Windows

Medium 6.0

In plain English

A medium-severity path traversal in vite from vitejs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.0Medium

Exploit odds (30 days)1.1%top 35.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Nuclei

Official description

Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows. Only apps explicitly exposing the Vite dev server to the network and running the dev server on Windows were affected. This issue has been patched in versions 5.4.21, 6.4.1, 7.0.8, and 7.1.11.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	vite	7.1.11	GHSA-93m4-6634-74q7
npm	vite	7.0.8	GHSA-93m4-6634-74q7
npm	vite	6.4.1	GHSA-93m4-6634-74q7
npm	vite	5.4.21	GHSA-93m4-6634-74q7
npm	vite	5.4.21	GHSA-93m4-6634-74q7
npm	vite	5.4.21	GHSA-93m4-6634-74q7
npm	vite	5.4.21	GHSA-93m4-6634-74q7

Affected products (as reported)

Vendor	Product	Versions
vitejs	vite	>= 7.1.0, < 7.1.11>= 7.0.0, < 7.0.8>= 6.0.0, < 6.4.1>= 5.2.6, < 5.4.21>= 4.5.3, < 5.0.0>= 3.2.9, < 4.0.0>= 2.9.18, < 3.0.0

Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/vitejs/vite/security/advisories/GHSA-93m4-6634-74q7 x_refsource_CONFIRM
https://github.com/vitejs/vite/commit/f479cc57c425ed41ceb434fecebd63931b1ed4ed x_refsource_MISC