Executive brief
Vite is a build tool and development server used by web developers to build and test applications. The vulnerability allows any HTML file on a machine to be served through Vite's dev server, bypassing the `server.fs` access control settings that are intended to restrict which files can be accessed. An attacker who can reach the dev server over the network can read sensitive HTML files outside the intended application directory or in restricted folders.
Technical details
The vulnerability is an authorization bypass in Vite's static file serving middleware. The `serveStaticMiddleware` function checks for ".html" file extensions and intentionally skips serving them directly, instead passing requests to downstream middlewares (`htmlFallbackMiddleware` and `indexHtmlMiddleware`). However, these downstream middlewares do not enforce `server.fs` allow/deny rules and do not verify that requested files are within the server root directory. This allows attackers to bypass access controls via path traversal (e.g., `/../../../tmp/secret.html`) or by requesting denied HTML files directly. The vulnerability requires the dev server to be exposed to the network (via `--host` or `server.host` config) and affects both development and preview servers. Patches are available in versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20.
Affected products
- Vite Vite 6.0.0 to 6.3.5, 7.0.0 to 7.0.6, 7.1.0 to 7.1.4, and earlier versions before 6.0.0 up to 5.4.19
Timeline
- 2025-09-08: disclosed: Vulnerability publicly disclosed via GHSA and GitHub advisory
- 2025-09-08: patched: Patches released: version 7.1.5, 7.0.7, 6.3.6, 5.4.20