CVE-2025-62522
mediumpriority · track · 0EPSS 0.011 · 64 %ileDEEUNLRUUSEPSS · scored 2026-10-27
Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows. Only apps explicitly exposing the Vite dev server to the network and running the dev server on Windows were affected. This issue has been patched in versions 5.4.21, 6.4.1, 7.0.8, and 7.1.11.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedSIDIS Primesiemens_psirt
Update to V4.0.800 or later version
- FixedSIDIS Primecisa_csaf_ot
Update to V4.0.800 or later version
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (151)
Products and version ranges known to be affected.
advisories (4)
Vendor and ecosystem advisories describing this.
- NCSC-2026-0079Kwetsbaarheden verholpen in Siemens productenNL2026-03-10csaf · ncsc_nlNL
Siemens heeft kwetsbaarheden verholpen in diverse producten als Heliox, Ruggedcom, SICAM, SIDIS en SIMATIC.
- SSA-485750SSA-485750: Multiple Vulnerabilities in SIDIS Prime Before V4.0.8002026-03-10csaf · siemens_psirtDE
SIDIS Prime before V4.0.800 is affected by multiple vulnerabilities in the components OpenSSL, SQLite, and several Node.js packages as described below. Siemens has released a new version of SIDIS Prime and recommends to update to the latest version.
- GHSA-93m4-6634-74q7vite allows server.fs.deny bypass via backslash on Windows2025-10-20ghsa · osvUS
### Summary Files denied by [`server.fs.deny`](https://vitejs.dev/config/server-options.html#server-fs-deny) were sent if the URL ended with `\` when the dev server is running on Windows. ### Impact Only apps that match the following conditions are affected: - explicitly exposes the Vite dev server to the network (using --host or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host)) - running the dev server on Windows ### Details `server.fs.deny` can contain patterns matching against files (by default it includes `.env`, `.env.*`, `*.{crt,pem}` as such patterns). These patterns were able to bypass by using a back slash(`\`). The root cause is that `fs.readFile('/foo.png/')` loads `/foo.png`. ### PoC ```shell npm create vite@latest cd vite-project/ cat "secret" > .env npm install npm run dev curl --request-target /.env\ http://localhost:5173 ``` <img width="1593" height="616" alt="image" src="https://github.com/user-attachments/assets/36212f4e-1d3c-4686-b16f-16b35ca9e175" />
- ICSA-26-071-03Siemens SIDIS Prime2026-03-10icsa · cisa_csaf_otUS
SIDIS Prime before V4.0.800 is affected by multiple vulnerabilities in the components OpenSSL, SQLite, and several Node.js packages as described below. Siemens has released a new version of SIDIS Prime and recommends to update to the latest version.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (7)
External citations — patches, advisories, analysis.
- https://github.com/vitejs/vite/commit/f479cc57c425ed41ceb434fecebd63931b1ed4edcnnvd
- https://github.com/vitejs/vite/releasesPatchcnnvd
- https://github.com/vitejs/vite/security/advisories/GHSA-93m4-6634-74q7cnnvd
- https://github.com/vitejs/vite/commit/f479cc57c425ed41ceb434fecebd63931b1ed4edenisa_euvd
- https://github.com/vitejs/vite/security/advisories/GHSA-93m4-6634-74q7enisa_euvd
- https://github.com/vitejs/vite/commit/f479cc57c425ed41ceb434fecebd63931b1ed4ednvd
- https://github.com/vitejs/vite/security/advisories/GHSA-93m4-6634-74q7nvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan