CVE-2025-58751: Vitejs Vite Path Traversal Vulnerability

CVE-2025-58751 Overview

CVE-2025-58751 is a path traversal vulnerability [CWE-22] in Vite, a widely used frontend tooling framework for JavaScript. The flaw allows the Vite development server to serve files that bypass the server.fs restrictions when a symlink exists inside the public directory. Attackers can request files whose names share a prefix with entries in the public directory to read files outside intended boundaries. The issue affects Vite versions prior to 7.1.5, 7.0.7, 6.3.6, and 5.4.20. Exploitation requires the dev server to be exposed to the network via --host or server.host, the public directory feature enabled, and a symlink present in that directory.

Critical Impact
Attackers on the same network as an exposed Vite dev server can read files outside the server.fs.allow boundary when a symlink exists in the public directory.

Affected Products

Vite >= 7.1.0, < 7.1.5
Vite >= 7.0.0, < 7.0.7
Vite >= 6.0.0, < 6.3.6
Vite < 5.4.20

Discovery Timeline

2025-09-08 - CVE-2025-58751 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58751

Vulnerability Analysis

Vite's development server serves static assets from the public directory in addition to source files governed by the server.fs allow-list. The vulnerability stems from how the underlying sirv static file handler resolves requested paths against public directory entries. Files whose names start with the same prefix as an entry in the public directory were served without applying the server.fs filesystem restrictions.

When a symlink is present inside the public directory, this prefix-matching behavior allows an attacker to construct requests that follow the symlink and reach files outside the project workspace. The result is unauthorized read access to files that server.fs.allow was configured to protect. The CWE-22 classification reflects the path traversal characteristic of the flaw.

Root Cause

The root cause is improper path normalization in the static file middleware. The public directory lookup used a prefix comparison rather than strict path segment equality, and symlink targets were not validated against the server.fs allow-list. Fix commits in both vitejs/vite and the upstream lukeed/sirv project correct the path handling.

Attack Vector

Exploitation requires network reachability to a Vite dev server started with --host or a truthy server.host config value. The attacker sends crafted HTTP requests to the dev server with paths that share a prefix with a symlinked entry in the public directory. Since Vite dev servers are intended for local development, production deployments are not directly affected, but shared networks, coworking spaces, and cloud dev environments create realistic exposure. No authentication is required, and user interaction is limited to the developer running the exposed dev server.

The vulnerability does not enable code execution or write access. Impact is confined to confidentiality of local files reachable through the symlink target.

Detection Methods for CVE-2025-58751

Indicators of Compromise

Unexpected HTTP GET requests to the Vite dev server for paths that share a prefix with files in the public directory but include additional characters or traversal segments.
Access log entries showing successful 200 responses for files that resolve outside the project root through a symlink target.
Presence of symbolic links inside the project public directory that point outside the project workspace.

Detection Strategies

Audit development environments for Vite versions below 7.1.5, 7.0.7, 6.3.6, and 5.4.20 using package manifests such as package.json and package-lock.json.
Inspect running Vite processes for --host flags or configuration files that set server.host to a non-loopback value.
Scan public directories in JavaScript projects for symbolic links using find ./public -type l.

Monitoring Recommendations

Alert on Vite dev server ports (default 5173) listening on non-loopback interfaces on developer workstations and CI runners.
Monitor egress and lateral connections to developer machines during active development sessions.
Log and review HTTP requests to dev servers when they are intentionally exposed for remote testing.

How to Mitigate CVE-2025-58751

Immediate Actions Required

Upgrade Vite to 7.1.5, 7.0.7, 6.3.6, or 5.4.20 depending on the major version in use.
Remove symbolic links from the public directory unless they are strictly required.
Stop exposing the dev server to untrusted networks. Bind to localhost during development.

Patch Information

The Vite maintainers released fixes across four release lines. Reference the GitHub Security Advisory GHSA-g4jq-h2w9-997c and the fix commits: vite commit 09f2b52e, vite commit 4f1c35bc, vite commit 63e2a5d2, vite commit e11d2400, and the upstream sirv commit f0113f3f.

Workarounds

Avoid using --host and leave server.host unset so the dev server binds only to loopback.
Disable the public directory feature by setting publicDir: false in vite.config.js when it is not needed.
Ensure no symbolic links exist in the public directory as a defensive measure.

bash

# Configuration example
npm install vite@7.1.5 --save-dev
# or for the 6.x line
npm install vite@6.3.6 --save-dev
# or for the 5.x line
npm install vite@5.4.20 --save-dev

# Verify no symlinks exist in the public directory
find ./public -type l