CVE-2025-58751: 
JavaScript vulnerability analysis and mitigation

CVE-2025-58751 is a path traversal vulnerability in Vite, a frontend tooling framework for JavaScript, that allows files outside the public directory to be served in bypass of server.fs access control settings. It affects Vite versions prior to 5.4.20, 6.x before 6.3.6, 7.0.x before 7.0.7, and 7.1.x before 7.1.5. The vulnerability was disclosed on September 8, 2025, via a GitHub Security Advisory. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 2.3 (Low), reflecting the narrow exploitation conditions required (GitHub Advisory).

The root cause is a combination of CWE-22 (Path Traversal), CWE-200 (Exposure of Sensitive Information), and CWE-284 (Improper Access Control) in how Vite's servePublicMiddleware and the underlying sirv static file serving library handle path boundary checks. When a symlink exists anywhere inside the public directory, the publicFiles variable becomes undefined, causing every request to be treated as a public file request and bypassing the server.fs deny list. The sirv library's viaLocal function uses String.startsWith() to verify that a resolved path is within the public directory root, but because sirv trims the trailing slash from the directory path, a normalized path like /www/private.txt incorrectly passes the check against a public directory of /www/p (since '/www/private.txt'.startsWith('/www/p') is true). An attacker can craft a request using .. traversal (e.g., /../private.txt) to reach files outside the public directory that are on the server.fs deny list. The fix in sirv 3.0.2 appends a path separator to the directory string before the startsWith comparison, closing the prefix-collision loophole (GitHub Advisory, sirv fix commit).

Successful exploitation allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem that are explicitly denied by the server.fs configuration, resulting in unauthorized disclosure of sensitive information such as configuration files, secrets, or source code. The impact is limited to confidentiality (no integrity or availability impact), and only affects the Vite development server — not production builds. Because Vite's dev server is not intended for production use, the real-world exposure is primarily in development or CI/CD environments where the server is inadvertently exposed to a network (GitHub Advisory).

1. Identify a vulnerable target: Locate a Vite development server exposed to the network (started with --host or server.host configured), running a version prior to 5.4.20, 6.3.6, 7.0.7, or 7.1.5.
2. Confirm symlink precondition: Verify (or know) that the application's public directory contains at least one symbolic link, which causes publicFiles to be undefined and disables the public file allowlist check.
3. Identify a target file: Determine the name of a sensitive file outside the public directory that shares a prefix with the public directory name (e.g., if the public directory is /www/p, target files like /www/private.txt are candidates).
4. Craft a traversal request: Send an HTTP GET request using .. path traversal to escape the public directory and reach the target file. For example: curl -v --path-as-is 'http://<target>:5173/../private.txt'
5. Receive file contents: Because the normalized path (/www/private.txt) passes the flawed startsWith('/www/p') check and the public middleware skips the server.fs deny list, the server responds with the file's contents instead of a 403 (GitHub Advisory).

• Network: HTTP GET requests to the Vite dev server (default port 5173) containing .. path traversal sequences (e.g., /../<filename>) in the URL path, particularly with the --path-as-is flag or equivalent raw path encoding.
• Logs: Vite dev server access logs showing requests with /../ in the path that return HTTP 200 responses for files not located within the public directory; unexpected 200 responses for files that should return 403 based on server.fs.deny configuration.
• File System: Presence of symbolic links within the Vite public directory (publicDir) pointing to locations inside or outside the project root, which is the prerequisite condition for triggering the vulnerability.

Upgrade Vite to one of the patched versions: 7.1.5, 7.0.7, 6.3.6, or 5.4.20, which include an updated sirv dependency (3.0.2 for Vite 7.x, with backported patches for older versions) that appends a path separator to the directory string before boundary checks. As an immediate workaround, avoid exposing the Vite dev server to the network by not using the --host flag or server.host configuration option. Additionally, audit and remove any symbolic links from the public directory, and review server.fs.deny configurations to ensure sensitive files are properly protected (GitHub Advisory, sirv fix commit).

The vulnerability was reported by security researcher orihjfrog and remediated with the cooperation of lukeed (the sirv library maintainer), as credited in the official advisory. The fix was applied both upstream in sirv 3.0.2 and backported via patches in the Vite repository for older supported branches. Community reaction has been limited given the narrow exploitation conditions; Nuclei templates for automated detection were added to the ProjectDiscovery nuclei-templates repository shortly after disclosure, indicating interest from the security scanning community (GitHub Advisory).