CVE-2025-58751 is a path traversal vulnerability affecting the Vite frontend tooling framework for JavaScript. This vulnerability exists in versions prior to 5.4.20, 6.3.6, 7.0.7, and 7.1.5. The root cause is that files starting with the same name as those in the public directory can be served by the Vite dev server while bypassing the server.fs configuration settings, which are intended to restrict file system access. This occurs only if the application explicitly exposes the Vite development server to the network (via the --host flag or server.host configuration), uses the public directory feature (enabled by default), and has a symbolic link within the public directory. Exploiting this vulnerability could allow an attacker to access files outside the intended restricted directory, potentially exposing sensitive information. However, exploitation requires that the Vite dev server be exposed to the network, and user interaction is needed to trigger the file access. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), CWE-200 (Exposure of Sensitive Information), and CWE-284 (Improper Access Control). The CVSS v4.0 base score is 2.3, indicating low severity, reflecting the limited impact and exploitation conditions. No known exploits are currently reported in the wild. The issue is fixed in versions 5.4.20, 6.3.6, 7.0.7, and 7.1.5 of Vite.

For European organizations, the impact of this vulnerability is generally low but context-dependent. Organizations using Vite as part of their frontend development environment and exposing the Vite dev server to external networks could inadvertently allow attackers to access files outside the intended public directory, potentially leaking sensitive development or configuration files. This could lead to information disclosure that might aid further attacks or intellectual property theft. However, since Vite is primarily a development tool and this vulnerability requires the dev server to be network-exposed (which is not a common production setup), the risk to production environments is minimal. The main risk lies in development or staging environments that are improperly exposed. European organizations with strict data protection regulations (e.g., GDPR) should be cautious about any unintended data exposure. Additionally, organizations relying on Vite for rapid frontend development in collaborative or cloud environments might face increased risk if network exposure is misconfigured.

1. Upgrade Vite to the fixed versions: 5.4.20, 6.3.6, 7.0.7, or 7.1.5 depending on the version series in use. 2. Avoid exposing the Vite development server to external networks unless absolutely necessary. Use localhost bindings or VPNs to restrict access. 3. Disable or carefully manage the public directory feature if symbolic links are used within it. 4. Implement network-level access controls (firewalls, IP whitelisting) to restrict access to development servers. 5. Regularly audit development and staging environments for unintended exposure of dev servers. 6. Educate development teams on secure configuration practices for development tools. 7. Monitor logs for unusual file access patterns that could indicate exploitation attempts. 8. If symbolic links in the public directory are required, ensure they do not point to sensitive directories or files.