Executive brief
Vite's development server can be tricked into serving files outside the configured public directory when a symbolic link exists in the public directory. This bypasses Vite's configured file access restrictions, allowing an attacker on the network to read sensitive files that should be blocked. The vulnerability only affects development instances that are explicitly exposed to the network and use symlinks in the public folder.
Technical details
The vulnerability is a path traversal (CWE-22) in Vite's servePublicMiddleware function. When a symlink exists in the public directory, the publicFiles variable becomes undefined, causing all requests to be treated as public files. The middleware uses the sirv library's path normalization, which incorrectly validates paths by using a string prefix check (startsWith) after normalization. An attacker can craft requests like `/../private.txt` which, after joining with the public directory path (e.g., `/www/p`) and normalizing, produces `/www/private.txt` that passes the prefix validation because it starts with `/www/p`, bypassing the configured fs.deny rules. The attack requires network exposure (--host configuration) and a symlink in the public directory. Patches are available in versions 5.4.20, 6.3.6, 7.0.7, and 7.1.5.
Affected products
- Vite Vite <=5.4.19, 6.0.0-6.3.5, 7.0.0-7.0.6, 7.1.0-7.1.4
Timeline
- 2025-09-08: disclosed: Advisory published
- 2025-09-09: patched: Patches released in versions 5.4.20, 6.3.6, 7.0.7, 7.1.5