CVE-2025-31125
highpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.658 · 99 %ileexploit · PoCEUUSadded 2026-01-22remediate by 2026-02-12
required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
EPSS · scored 2026-10-26
Vite Vitejs Improper Access Control Vulnerability
Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.3–7.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (4)
Public proof-of-concept and weaponised exploit code.
- 0xgh057r3c0n/CVE-2025-31125Vite WASM Import Path Traversal 🛡️PoC · poc_in_github
- sunhuiHi666/CVE-2025-31125Vite 任意文件读取漏洞POCPoC · poc_in_github
affected products (15)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-4r4m-qw57-chr8Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query2025-03-31ghsa · osvUS
### Summary The contents of arbitrary files can be returned to the browser. ### Impact Only apps explicitly exposing the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host)) are affected. ### Details - base64 encoded content of non-allowed files is exposed using `?inline&import` (originally reported as `?import&?inline=1.wasm?init`) - content of non-allowed files is exposed using `?raw?import` `/@fs/` isn't needed to reproduce the issue for files inside the project root. ### PoC Original report (check details above for simplified cases): The ?import&?inline=1.wasm?init ending allows attackers to read arbitrary files and returns the file content if it exists. Base64 decoding needs to be performed twice ``` $ npm create vite@latest $ cd vite-project/ $ npm install $ npm run dev ``` Example full URL `http://localhost:5173/@fs/C:/windows/win.ini?import&?inline=1.wasm?init`
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (7)
External citations — patches, advisories, analysis.
- https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8Patchcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2025-31125cnnvd
- https://github.com/vitejs/vite/commit/59673137c45ac2bcfad1170d954347c1a17ab949enisa_euvd
- https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8enisa_euvd
- https://github.com/vitejs/vite/commit/59673137c45ac2bcfad1170d954347c1a17ab949Patchnvd
- https://github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8ExploitVendor Advisorynvd
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-31125US Government Resourcenvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan