Executive brief
vite-plugin-static-copy is a Vite build tool plugin that copies static files during development and build. When the Vite dev server is exposed to the network, attackers can use crafted path-traversal requests (e.g., `../../../etc/passwd`) to read arbitrary files from the server's filesystem, bypassing the intended restrictions on which directories can be served. This allows disclosure of sensitive files like configuration or source code.
Technical details
The vulnerability is a path-traversal flaw (CWE-22) in vite-plugin-static-copy's request handling. When configured to serve files from a specific source directory (e.g., `./public/images`), the plugin fails to properly normalize or validate request paths, allowing an attacker to inject `..` sequences to escape the intended directory boundary. The attack requires the Vite dev server to be explicitly exposed to the network (via `--host` or `server.host` config), but then any unauthenticated attacker on the network can send a GET request with a crafted path to read arbitrary files. The vulnerability affects versions 0.4.3 through 2.3.1 and 3.0.0 through 3.1.1; patches are available in versions 2.3.2 and 3.1.2.
Affected products
- sapphi-red vite-plugin-static-copy 0.4.3 to 2.3.1, 3.0.0 to 3.1.1
Timeline
- 2025-08-21: disclosed
- 2025-08-21: patched: Fixed in versions 2.3.2 and 3.1.2