CVE-2025-58752

Katalog CVE

CVSS 5.3 · Medium EPSS 0,61%

Kerentanan Relative Path Traversal pada vitejs vite. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, any HTML files on the machine were served regardless of the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or server.host config option) and use `appType: 'spa'` (default) or `appType: 'mpa'` are affected. This vulnerability also affects the preview server. The preview server allowed HTML files not under the output directory to be served. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.

Rincian

Terbit di NVD

8 September 2025

Terakhir diubah

30 September 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-23: Relative Path Traversal
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-284: Improper Access Control

EPSS (30 hari)

0,61% peluang dieksploitasi; lebih tinggi dari 47,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/vitejs/vite/commit/0ab19ea9fcb66f544328f442cf6e70f7c0528d5f patch
• https://github.com/vitejs/vite/commit/14015d794f69accba68798bd0e15135bc51c9c1e patch
• https://github.com/vitejs/vite/commit/482000f57f56fe6ff2e905305100cfe03043ddea patch
• https://github.com/vitejs/vite/commit/6f01ff4fe072bcfcd4e2a84811772b818cd51fe6 patch
• https://github.com/vitejs/vite/security/advisories/GHSA-jqfw-vq24-v9c3 exploit · advisory pihak ketiga