CVE-2025-62522 vite allows server.fs.deny bypass via backslash on Windows
Attackers can bypass file access restrictions to read denied files on Windows dev servers exposed to the network.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-62522?
CVE-2025-62522 is a medium-severity path traversal vulnerability in vitejs vite, published on 20 Oct 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows. Only apps explicitly exposing the Vite dev server to the network and running the dev server on Windows were affected. This issue has been patched in versions 5.4.21, 6.4.1, 7.0.8, and 7.1.11.
Weakness: CWE-22
Which versions are affected by CVE-2025-62522?
14 open source packages ship an affected version, including vite.
| Package | Affected | Fixed in |
|---|---|---|
vite npm | From 2.9.18 | 5.4.21 |
vite npm | From 2.9.18 | 5.4.21 |
vite npm | From 3.2.9 | 5.4.21 |
vite npm | From 3.2.9 | 5.4.21 |
vite npm | From 4.5.3 | 5.4.21 |
vite npm | From 4.5.3 | 5.4.21 |
8 more packages
vite npm | From 5.2.6 | 5.4.21 |
vite npm | From 5.2.6 | 5.4.21 |
vite npm | From 6.0.0 | 6.4.1 |
vite npm | From 6.0.0 | 6.4.1 |
vite npm | From 7.0.0 | 7.0.8 |
vite npm | From 7.0.0 | 7.0.8 |
vite npm | From 7.1.0 | 7.1.11 |
vite npm | From 7.1.0 | 7.1.11 |
How do I fix CVE-2025-62522?
Upgrade vite to a fixed version for your release line: 5.4.21, 6.4.1, 7.0.8 or 7.1.11.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-62522 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-62522 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as CLSA-2026-1779065186, CLSA-2026-1783558962, CLSA-2026-1790458381, CLSA-2026-1791806508, CLSA-2026-1792161447, CLSA-2026-1792161548 and 9 more.