# CVE-2025-58751: Vite path traversal in public directory middleware

Source: https://junglewise.ai/threats/cve-2025-58751-vite-path-traversal-in-public-directory-middleware  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-09-09. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-58751 · Severity: medium · CVSS 4 · Published 2025-09-09

Vite's development server can be tricked into serving files outside the configured public directory when a symbolic link exists in the public directory. This bypasses Vite's configured file access restrictions, allowing an attacker on the network to read sensitive files that should be blocked. The vulnerability only affects development instances that are explicitly exposed to the network and use symlinks in the public folder.

Technologies: [Vite](https://junglewise.ai/threats/technologies/vite). Vendors: [Vite](https://junglewise.ai/threats/vendors/vite).

## Quick answers

**Is CVE-2025-58751 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-58751 being exploited in the wild.

**How severe is CVE-2025-58751?** Medium severity, with a CVSS score of 4, published 9 September 2025.

**Which products and versions are affected?** Vite <=5.4.19, 6.0.0-6.3.5, 7.0.0-7.0.6, 7.1.0-7.1.4.

**Is there a fix for CVE-2025-58751?** A patch was published on 2025-09-09: Patches released in versions 5.4.20, 6.3.6, 7.0.7, 7.1.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-58751 attacked?** It is attacked over the network.

**Am I affected by CVE-2025-58751?** Check whether you run Vite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a path traversal (CWE-22) in Vite's servePublicMiddleware function. When a symlink exists in the public directory, the publicFiles variable becomes undefined, causing all requests to be treated as public files. The middleware uses the sirv library's path normalization, which incorrectly validates paths by using a string prefix check (startsWith) after normalization. An attacker can craft requests like `/../private.txt` which, after joining with the public directory path (e.g., `/www/p`) and normalizing, produces `/www/private.txt` that passes the prefix validation because it starts with `/www/p`, bypassing the configured fs.deny rules. The attack requires network exposure (--host configuration) and a symlink in the public directory. Patches are available in versions 5.4.20, 6.3.6, 7.0.7, and 7.1.5.

## Affected products

- Vite Vite <=5.4.19, 6.0.0-6.3.5, 7.0.0-7.0.6, 7.1.0-7.1.4

## Identifiers

- CVE-2025-58751
- GHSA-g4jq-h2w9-997c

## Timeline

- 2025-09-08: disclosed: Advisory published
- 2025-09-09: patched: Patches released in versions 5.4.20, 6.3.6, 7.0.7, 7.1.5

## References

- [https://github.com/vitejs/vite/security/advisories/GHSA-g4jq-h2w9-997c](https://github.com/vitejs/vite/security/advisories/GHSA-g4jq-h2w9-997c)

## Related threats

- [Vite development server file access bypass via query parameters](https://junglewise.ai/threats/cve-2026-118662-vite-is-a-frontend-tooling-framework-for-javascript-from-6-4-4)
- [Vite information disclosure via WebAssembly query parameter](https://junglewise.ai/threats/cve-2026-112947-vite-is-a-frontend-tooling-framework-for-javascript-from-8-2-0)
- [Vite path traversal in transformIndexHtml](https://junglewise.ai/threats/cve-2026-112945-vite-is-a-frontend-tooling-framework-for-javascript-prior-to-6-4)
- [Vitejs launch-editor NTLM hash disclosure via UNC path handling](https://junglewise.ai/threats/cve-2026-53632-vitejs-launch-editor-ntlm-hash-disclosure-via-unc-path-handling)
- [Vite path traversal and sensitive file disclosure on Windows via NTFS ADS](https://junglewise.ai/threats/cve-2026-53571-vite-path-traversal-and-sensitive-file-disclosure-on-windows-via)