CVE-2025-58752: Vitejs Vite Path Traversal Vulnerability

CVE-2025-58752 Overview

CVE-2025-58752 is a path traversal vulnerability [CWE-23] affecting the Vite frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, any HTML file on the developer's machine could be served regardless of the server.fs restriction settings. The flaw affects both the Vite dev server and the preview server, with the preview server allowing HTML files outside the configured output directory to be served. Only applications that explicitly expose the Vite dev server to the network via --host or the server.host configuration option, and use appType: 'spa' (default) or appType: 'mpa', are impacted.

Critical Impact
Remote unauthenticated clients on the same network can retrieve arbitrary HTML files from the host filesystem, bypassing server.fs allowlist restrictions.

Affected Products

Vite versions prior to 5.4.20 (5.x branch)
Vite versions prior to 6.3.6 (6.x branch)
Vite versions prior to 7.0.7 and 7.1.5 (7.x branch)

Discovery Timeline

2025-09-08 - CVE-2025-58752 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58752

Vulnerability Analysis

The vulnerability resides in how Vite's dev server and preview server handle requests for HTML files. Vite provides a server.fs configuration intended to restrict file system access to an allowlist of directories. However, the HTML-serving code path did not consult these restrictions, treating HTML files as a special case. As a result, an attacker who can reach the dev server over the network can request HTML files located outside the project root using traversal sequences. The preview server exhibited a parallel issue, serving HTML files not located under the build output directory.

Root Cause

The root cause is missing enforcement of the fs.strict check on HTML file responses within the middleware pipeline. The dev server's indexHtml middleware and the preview server's static file handler resolved HTML paths without validating that the resolved path was a descendant of the allowed roots. The absence of a parent-directory containment check permitted resolution to arbitrary filesystem locations.

Attack Vector

Exploitation requires the developer to run Vite with network exposure enabled through --host or server.host, and use the default appType: 'spa' or appType: 'mpa'. An attacker on the same network sends crafted HTTP requests containing path traversal sequences targeting .html files. User interaction is required, as the developer must have started the vulnerable server. Successful requests return the contents of HTML files anywhere on the host filesystem readable by the Vite process.

typescript

// Security patch in packages/vite/src/node/server/middlewares/indexHtml.ts
// Source: https://github.com/vitejs/vite/commit/0ab19ea9fcb66f544328f442cf6e70f7c0528d5f
   injectQuery,
   isDevServer,
   isJSRequest,
+  isParentDirectory,
   joinUrlSegments,
   normalizePath,
   processSrcSetSync,

The fix imports isParentDirectory and normalizePath utilities into the HTML middleware and preview server. The added checks enforce that resolved HTML paths must be descendants of allowed roots before content is returned.

Detection Methods for CVE-2025-58752

Indicators of Compromise

HTTP requests to the Vite dev server (typically port 5173) or preview server (typically port 4173) containing traversal patterns such as ../ or absolute paths targeting .html files.
Access log entries showing successful 200 responses for HTML paths outside the project root or configured output directory.
Unexpected inbound connections to developer workstations running Vite on non-loopback interfaces.

Detection Strategies

Inventory installed Vite versions across developer machines and CI runners using npm ls vite or lockfile scanning, flagging versions below 5.4.20, 6.3.6, 7.0.7, and 7.1.5.
Monitor for Vite processes bound to non-loopback addresses by inspecting network listeners for node processes running with --host.
Review project configuration files (vite.config.js, vite.config.ts) for server.host settings that expose the dev server externally.

Monitoring Recommendations

Alert on network connections to developer subnets targeting common Vite ports from unexpected sources.
Log and review HTTP request paths on developer proxies for traversal signatures like %2e%2e%2f or ..%2f targeting .html extensions.
Track outbound telemetry from build servers to identify unexpected HTML file access patterns.

How to Mitigate CVE-2025-58752

Immediate Actions Required

Upgrade Vite to a patched version: 5.4.20, 6.3.6, 7.0.7, or 7.1.5 depending on your major version branch.
Audit all vite.config.js and vite.config.ts files for use of server.host or --host flags that expose the dev server to the network.
Restart any long-running Vite dev or preview server instances after upgrading to load the patched middleware.

Patch Information

The fix is distributed across four commits in the Vite repository, applying fs.strict enforcement to HTML file responses in both the dev server (packages/vite/src/node/server/middlewares/indexHtml.ts) and preview server (packages/vite/src/node/preview.ts). See the GitHub Security Advisory GHSA-jqfw-vq24-v9c3 and the primary fix commit for details.

Workarounds

Bind the Vite dev server to localhost only by removing --host flags and server.host configuration entries.
Use an SSH tunnel or reverse proxy with authentication instead of exposing the dev server directly to the network.
Restrict developer network segments with host-based firewall rules blocking inbound connections to ports 5173 and 4173.

bash

# Upgrade Vite to a patched version
npm install vite@^7.1.5   # for 7.x users
npm install vite@^6.3.6   # for 6.x users
npm install vite@^5.4.20  # for 5.x users

# Verify installed version
npx vite --version