CVE-2025-46565
mediumpriority · track · 21EPSS 0.012 · 69 %ileEUUSEPSS · scored 2026-10-27
Vite is a frontend tooling framework for javascript. Prior to versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. Only files that are under project root and are denied by a file matching pattern can be bypassed. `server.fs.deny` can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns). These patterns were able to bypass for files under `root` by using a combination of slash and dot (/.). This issue has been patched in versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (15)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-859w-5945-r5v3Vite's server.fs.deny bypassed with /. for files under project root2025-04-30ghsa · osvUS
### Summary The contents of files in [the project `root`](https://vite.dev/config/shared-options.html#root) that are denied by a file matching pattern can be returned to the browser. ### Impact Only apps explicitly exposing the Vite dev server to the network (using --host or [server.host config option](https://vitejs.dev/config/server-options.html#server-host)) are affected. Only files that are under [project `root`](https://vite.dev/config/shared-options.html#root) and are denied by a file matching pattern can be bypassed. - Examples of file matching patterns: `.env`, `.env.*`, `*.{crt,pem}`, `**/.env` - Examples of other patterns: `**/.git/**`, `.git/**`, `.git/**/*` ### Details [`server.fs.deny`](https://vite.dev/config/server-options.html#server-fs-deny) can contain patterns matching against files (by default it includes `.env`, `.env.*`, `*.{crt,pem}` as such patterns). These patterns were able to bypass for files under `root` by using a combination of slash and dot (`/.`). ### PoC ``` npm create vite@latest cd vite-project/ cat "secret" > .env npm install npm run dev curl --request-target /.env/. http://localhost:5173 ```  
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (8)
External citations — patches, advisories, analysis.
- https://github.com/vitejs/vite/commit/c22c43de612eebb6c182dd67850c24e4fab8cacbcnnvd
- https://github.com/vitejs/vite/releasesPatchcnnvd
- https://github.com/vitejs/vite/security/advisories/GHSA-859w-5945-r5v3cnnvd
- https://vigilance.fr/vulnerability/Node-js-vite-ingress-filtrering-bypass-via-server-fs-deny-47470cnnvd
- https://github.com/vitejs/vite/commit/c22c43de612eebb6c182dd67850c24e4fab8cacbenisa_euvd
- https://github.com/vitejs/vite/security/advisories/GHSA-859w-5945-r5v3enisa_euvd
- https://github.com/vitejs/vite/commit/c22c43de612eebb6c182dd67850c24e4fab8cacbPatchnvd
- https://github.com/vitejs/vite/security/advisories/GHSA-859w-5945-r5v3ExploitVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan