CVE-2025-31486 is a vulnerability in Vite dev server versions >=2.5.1 <6.2.5 that allows bypassing the server.fs.deny restriction to read arbitrary files. The bypass exploits two mechanisms: requests ending with .svg combined with query parameters or headers that cause the server to inline small assets, and relative path traversal due to checks applied before id normalization. This vulnerability only affects applications explicitly exposing the Vite dev server to the network (e.g., using --host). The flaw enables an attacker to retrieve arbitrary file contents from the server filesystem, demonstrated by reading /etc/passwd. The vulnerability has a CVSS 3.1 score of 5.3 (medium severity). A patch is available to address this issue.

An attacker can retrieve the contents of arbitrary files from the server running the Vite development server if it is exposed to the network. This can lead to disclosure of sensitive information. The vulnerability requires network exposure of the dev server and files smaller than the inline asset limit (default 4kB) for the .svg bypass. The relative path bypass allows traversal to arbitrary files. There is no indication of code execution or integrity impact. The CVSS score is 5.3, reflecting a medium severity confidentiality impact with high attack complexity and required user interaction.

A patch is available for Vite versions affected by this vulnerability. Users should upgrade to version 6.2.5 or later where this issue is fixed. If upgrading immediately is not possible, avoid exposing the Vite development server to the network (do not use --host or server.host configuration to allow external access). Restrict access to the dev server to trusted local environments only. Check the official Vite release notes or vendor advisory for the exact patched versions and update instructions.