CVE-2025-46565: Vite's server.fs.deny bypassed with /. for files under project root
Summary The contents of files in the project root that are denied by a file matching pattern can be returned to the browser.
Impact
Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. Only files that are under project root and are denied by a file matching pattern can be bypassed.
- Examples of file matching patterns: .env, .env., .{crt,pem}, /.env - Examples of other patterns: /.git/, .git/, .git//
Details server.fs.deny can contain patterns matching against files (by default it includes .env, .env., .{crt,pem} as such patterns). These patterns were able to bypass for files under root by using a combination of slash and dot (/.).
PoC npm create vite@latest cd vite-project/ cat "secret" > .env npm install npm run dev curl --request-target /.env/. http://localhost:5173
!image !image
Other sources
Vite is a frontend tooling framework for javascript. Prior to versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. Only files that are under project root and are denied by a file matching pattern can be bypassed. server.fs.deny can contain patterns matching against files (by default it includes .env, .env., .{crt,pem} as such patterns). These patterns were able to bypass for files under root by using a combination of slash and dot (/.). This issue has been patched in versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-46565?
CVE-2025-46565 is classified as a moderate severity vulnerability due to potential information disclosure risks.
How do I fix CVE-2025-46565?
To fix CVE-2025-46565, upgrade to Vite version 4.5.14, 5.4.19, 6.1.6, 6.2.7, or 6.3.4 or higher.
What type of applications are affected by CVE-2025-46565?
CVE-2025-46565 affects applications that expose the Vite dev server to the network.
What files are impacted by CVE-2025-46565?
CVE-2025-46565 may allow unauthorized access to contents of files that are denied by specific file matching patterns.
How can I determine if I am vulnerable to CVE-2025-46565?
To determine if you are vulnerable to CVE-2025-46565, check if you are running a version of Vite prior to the remedied versions and if your server is exposed to the network.