CVE-2025-58752
Vite's `server.fs` settings were not applied to HTML files
- State
- Published
- Severity
- 2.3 Low
- Published
- Sep 8, 2025
- Updated
- Sep 9, 2025
- Reserved
- Sep 4, 2025
Description
Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, any HTML files on the machine were served regardless of the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or server.host config option) and use `appType: 'spa'` (default) or `appType: 'mpa'` are affected. This vulnerability also affects the preview server. The preview server allowed HTML files not under the output directory to be served. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 2.3 Low | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | GitHub_M |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
vitevitejs |
|
References
- https://github.com/vitejs/vite/security/advisories/GHSA-jqfw-vq24-v9c3
- https://github.com/vitejs/vite/commit/0ab19ea9fcb66f544328f442cf6e70f7c0528d5f
- https://github.com/vitejs/vite/commit/14015d794f69accba68798bd0e15135bc51c9c1e
- https://github.com/vitejs/vite/commit/482000f57f56fe6ff2e905305100cfe03043ddea
- https://github.com/vitejs/vite/commit/6f01ff4fe072bcfcd4e2a84811772b818cd51fe6
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.