# CVE-2025-58752: Vite authorization bypass in HTML file serving

Source: https://junglewise.ai/threats/cve-2025-58752-vite-authorization-bypass-in-html-file-serving  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-09-09. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-58752 · Severity: medium · CVSS 4 · Published 2025-09-09

Vite is a build tool and development server used by web developers to build and test applications. The vulnerability allows any HTML file on a machine to be served through Vite's dev server, bypassing the `server.fs` access control settings that are intended to restrict which files can be accessed. An attacker who can reach the dev server over the network can read sensitive HTML files outside the intended application directory or in restricted folders.

Technologies: [Vite](https://junglewise.ai/threats/technologies/vite). Vendors: [Vite](https://junglewise.ai/threats/vendors/vite).

## Quick answers

**Is CVE-2025-58752 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-58752 being exploited in the wild.

**How severe is CVE-2025-58752?** Medium severity, with a CVSS score of 4, published 9 September 2025.

**Which products and versions are affected?** Vite 6.0.0 to 6.3.5, 7.0.0 to 7.0.6, 7.1.0 to 7.1.4, and earlier versions before 6.0.0 up to 5.4.19.

**Is there a fix for CVE-2025-58752?** A patch was published on 2025-09-08: Patches released: version 7.1.5, 7.0.7, 6.3.6, 5.4.20 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-58752 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-58752?** Check whether you run Vite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass in Vite's static file serving middleware. The `serveStaticMiddleware` function checks for ".html" file extensions and intentionally skips serving them directly, instead passing requests to downstream middlewares (`htmlFallbackMiddleware` and `indexHtmlMiddleware`). However, these downstream middlewares do not enforce `server.fs` allow/deny rules and do not verify that requested files are within the server root directory. This allows attackers to bypass access controls via path traversal (e.g., `/../../../tmp/secret.html`) or by requesting denied HTML files directly. The vulnerability requires the dev server to be exposed to the network (via `--host` or `server.host` config) and affects both development and preview servers. Patches are available in versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20.

## Affected products

- Vite Vite 6.0.0 to 6.3.5, 7.0.0 to 7.0.6, 7.1.0 to 7.1.4, and earlier versions before 6.0.0 up to 5.4.19

## Identifiers

- CVE-2025-58752
- GHSA-jqfw-vq24-v9c3

## Timeline

- 2025-09-08: disclosed: Vulnerability publicly disclosed via GHSA and GitHub advisory
- 2025-09-08: patched: Patches released: version 7.1.5, 7.0.7, 6.3.6, 5.4.20

## References

- [https://github.com/vitejs/vite/security/advisories/GHSA-jqfw-vq24-v9c3](https://github.com/vitejs/vite/security/advisories/GHSA-jqfw-vq24-v9c3)

## Related threats

- [Vite development server file access bypass via query parameters](https://junglewise.ai/threats/cve-2026-118662-vite-is-a-frontend-tooling-framework-for-javascript-from-6-4-4)
- [Vite information disclosure via WebAssembly query parameter](https://junglewise.ai/threats/cve-2026-112947-vite-is-a-frontend-tooling-framework-for-javascript-from-8-2-0)
- [Vite path traversal in transformIndexHtml](https://junglewise.ai/threats/cve-2026-112945-vite-is-a-frontend-tooling-framework-for-javascript-prior-to-6-4)
- [Vitejs launch-editor NTLM hash disclosure via UNC path handling](https://junglewise.ai/threats/cve-2026-53632-vitejs-launch-editor-ntlm-hash-disclosure-via-unc-path-handling)
- [Vite path traversal and sensitive file disclosure on Windows via NTFS ADS](https://junglewise.ai/threats/cve-2026-53571-vite-path-traversal-and-sensitive-file-disclosure-on-windows-via)