N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-62522

CVE-2025-62522: vite allows server.fs.deny bypass via backslash on Windows

Summary

Files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows.

Impact

Only apps that match the following conditions are affected:

explicitly exposes the Vite dev server to the network (using --host or server.host config option)
running the dev server on Windows

Details

server.fs.deny can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns). These patterns were able to bypass by using a back slash(\). The root cause is that fs.readFile('/foo.png/') loads /foo.png.

PoC

npm create vite@latest
cd vite-project/
cat "secret" > .env
npm install
npm run dev
curl --request-target /.env\ http://localhost:5173

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-62522

CVE-2025-62522:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
vite	npm	>= 7.1.0, <= 7.1.10	7.1.11
vite	npm	>= 7.0.0, <= 7.0.7	7.0.8
vite	npm	>= 6.0.0, <= 6.4.0	6.4.1
vite	npm	>= 2.9.18, < 3.0.0	5.4.21
vite	npm	>= 3.2.9, < 4.0.0	5.4.21
vite	npm	>= 4.5.3, < 5.0.0	5.4.21
vite	npm	>= 5.2.6, <= 5.4.20	5.4.21

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the isFileLoadingAllowed function located in packages/vite/src/node/server/middlewares/static.ts. This function is intended to prevent access to sensitive files as defined in the server.fs.deny configuration of Vite. The flaw is that the function did not properly sanitize the input file path before checking it against the deny list. Specifically, it did not account for trailing slashes in the path. On Windows systems, an attacker could request a denied file by appending a backslash to the URL (e.g., /.env\\). The Vite development server would process this path with a trailing slash. While the config.fsDenyGlob check would fail to recognize /.env/ as a denied path, the underlying Node.js fs.readFile call would treat /.env/ as /.env and serve the file's contents. The provided patch rectifies this by adding logic to isFileLoadingAllowed to remove any trailing slashes from the file path before it is passed to config.fsDenyGlob, ensuring that paths like /.env/ are correctly identified as denied. Therefore, any runtime profile of a vulnerable application would show the isFileLoadingAllowed function being called during an exploit attempt.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-62522: vite allows server.fs.deny bypass via backslash on Windows

Summary

Impact

Details

PoC

CVE-2025-62522:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

CVE-2025-62522: vite allows server.fs.deny bypass via backslash on Windows

Summary

Impact

Details

PoC

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

N/A

N/A

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI