Quick answers
- Is CVE-2025-62522 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-62522 being exploited in the wild.
- How severe is CVE-2025-62522?
- Medium severity, with a CVSS score of 4, published 20 October 2025.
- Which products and versions are affected?
- Vite >=2.9.18,<3.0.0; >=3.2.9,<4.0.0; >=4.5.3,<5.0.0; >=5.2.6,<=5.4.20; >=6.0.0,<=6.4.0; >=7.0.0,<=7.0.7; >=7.1.0,<=7.1.10.
- Is there a fix for CVE-2025-62522?
- A patch was published on 2025-10-20: Patches released in versions 5.4.21, 6.4.1, 7.0.8, 7.1.11 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-62522 attacked?
- It is attacked over the network.
- Am I affected by CVE-2025-62522?
- Check whether you run Vite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a path traversal bypass (CWE-22) affecting Vite's file serving restrictions on Windows. The vulnerability stems from fs.readFile('/foo.png/') loading '/foo.png', which allows an attacker to bypass patterns in server.fs.deny by appending a backslash to the request URL (e.g., /.env\). The attack requires the dev server to be running on Windows and explicitly exposed to the network via --host or server.host configuration. An unauthenticated network attacker can read files that should be denied by default (including .env, .env.*, and certificate/key files). Patches are available in versions 5.4.21, 6.4.1, 7.0.8, and 7.1.11 or later.
Affected products
- Vite Vite >=2.9.18,<3.0.0; >=3.2.9,<4.0.0; >=4.5.3,<5.0.0; >=5.2.6,<=5.4.20; >=6.0.0,<=6.4.0; >=7.0.0,<=7.0.7; >=7.1.0,<=7.1.10
Identifiers
- CVE-2025-62522
- GHSA-93m4-6634-74q7
Timeline
- 2025-10-20: disclosed: Advisory published
- 2025-10-20: patched: Patches released in versions 5.4.21, 6.4.1, 7.0.8, 7.1.11