CVE-2025-58752: 
JavaScript vulnerability analysis and mitigation

CVE-2025-58752 is a relative path traversal vulnerability in Vite, a frontend JavaScript tooling framework, where the server.fs filesystem access control settings were not applied to HTML files. This allowed any HTML file on the host machine to be served regardless of configured allow/deny rules. Affected versions include all Vite releases before 5.4.20, 6.x before 6.3.6, 7.0.x before 7.0.7, and 7.1.x before 7.1.5. The vulnerability was disclosed on September 8, 2025, and carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 2.3 (Low) (GitHub Advisory).

The root cause lies in how Vite's serveStaticMiddleware handles HTML file requests (CWE-23: Relative Path Traversal, CWE-200: Exposure of Sensitive Information, CWE-284: Improper Access Control). When a request targets a .html file, viteServeStaticMiddleware skips serving it directly and passes control to htmlFallbackMiddleware and then indexHtmlMiddleware. These downstream middlewares did not enforce server.fs allow/deny rules and did not verify that the requested file resided within the server's root directory, enabling path traversal via sequences like ../../../tmp/secret.html. The preview server was also affected, as it permitted HTML files outside the configured output directory to be served. A public proof-of-concept is included in the official advisory (GitHub Advisory, Patch Commit).

Successful exploitation allows an unauthenticated remote attacker to read arbitrary HTML files from the host machine's filesystem, bypassing any server.fs deny lists or allow lists configured by the developer. This is a confidentiality-only impact — there is no integrity or availability impact. The scope is limited to environments where the Vite dev or preview server is explicitly exposed to the network (via --host or server.host) and uses the default appType: 'spa' or appType: 'mpa' configuration; servers bound only to localhost are not affected (GitHub Advisory).

A proof-of-concept exploit is publicly available in the official security advisory, demonstrating exploitation via a simple curl command with path traversal sequences. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.048% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Identify a vulnerable target: Locate a Vite dev or preview server exposed to the network (started with --host or server.host configured), running a version prior to 5.4.20, 6.3.6, 7.0.7, or 7.1.5, with appType: 'spa' (default) or appType: 'mpa'.
2. Craft a path traversal request: Construct an HTTP GET request using relative path traversal sequences to reference an HTML file outside the server root. For example:

   curl -v --path-as-is 'http://<target>:5173/../../../../../../../../../../../tmp/secret.html'

3. Bypass deny list for in-root HTML files: If the target has a server.fs.deny rule covering specific HTML files, request those files directly by path (e.g., /secret_files/secret.html). The indexHtmlMiddleware will serve them without checking the deny list.
4. Retrieve file contents: The server responds with the full contents of the targeted HTML file, bypassing all configured filesystem access controls (GitHub Advisory).

• Network: Unusual HTTP GET requests to the Vite dev server (default port 5173) or preview server containing ../ or URL-encoded path traversal sequences (e.g., %2e%2e%2f) in the request path targeting .html files.
• Logs: Vite server access logs showing requests to paths outside the project root resolving to .html files with HTTP 200 responses; requests to paths matching configured server.fs.deny patterns for HTML files that returned 200 instead of 403.
• Network: Requests originating from unexpected external IP addresses to the Vite development server port, particularly if the server was not intentionally exposed to the network.

Upgrade Vite to one of the patched versions: 5.4.20, 6.3.6, 7.0.7, or 7.1.5, which apply server.fs access controls to HTML files in both the dev and preview servers. As an immediate workaround, avoid exposing the Vite dev or preview server to the network by not using --host or server.host unless strictly necessary. Additionally, implement network segmentation to restrict access to development servers to trusted hosts only (GitHub Advisory, Patch Commit).