CVE-2025-31125 Vite Vitejs Improper Access Control
Attackers can bypass file access restrictions to read sensitive files if the Vite dev server is exposed to the network.
- Exploited in the wild
- Since 22 Jan 2026
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-31125?
CVE-2025-31125 is a medium-severity path traversal vulnerability in vitejs vite, published on 31 Mar 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.
Which versions are affected by CVE-2025-31125?
10 open source packages ship an affected version, including vite. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
vite npm | All versions | 4.5.11 |
vite npm | All versions | 4.5.11 |
vite npm | From 5.0.0 | 5.4.16 |
vite npm | From 5.0.0 | 5.4.16 |
vite npm | From 6.0.0 | 6.0.13 |
vite npm | From 6.0.0 | 6.0.13 |
4 more packages
vite npm | From 6.1.0 | 6.1.3 |
vite npm | From 6.1.0 | 6.1.3 |
vite npm | From 6.2.0 | 6.2.4 |
vite npm | From 6.2.0 | 6.2.4 |
Products include Vitejs Vite.
How do I fix CVE-2025-31125?
Upgrade vite to a fixed version for your release line: 4.5.11, 5.4.16, 6.0.13 or 6.1.3. US federal agencies must fix it by 12 Feb 2026.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-31125 being exploited?
Yes. Attackers have exploited CVE-2025-31125 in the wild since at least 22 Jan 2026.
Public exploit code: 1 Nuclei template and 4 proofs of concept on GitHub.
Other vulnerabilities in vitejs vite
- CVE-2026-53571 Vite: `server.fs.deny` bypass on Windows alternate paths
- CVE-2026-39363 Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket
- CVE-2026-39364 Vite has a `server.fs.deny` bypass with queries
- CVE-2024-23331 Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem
- CVE-2023-34092 Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)
Sources
Also known as GHSA-4r4m-qw57-chr8, MINI-qj5j-42h3-7rfg.