# CVE-2025-62522: Vite server.fs.deny bypass via backslash on Windows

Source: https://junglewise.ai/threats/cve-2025-62522-vite-server-fs-deny-bypass-via-backslash-on-windows  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-62522 · Severity: medium · CVSS 4 · Published 2025-10-20

Vite is a popular build tool and development server for modern JavaScript applications. On Windows systems, an attacker can bypass file access restrictions (server.fs.deny) by appending a backslash to URLs, allowing exposure of sensitive files like environment configuration and cryptographic keys. This only affects development servers explicitly exposed to the network.

Technologies: [Vite](https://junglewise.ai/threats/technologies/vite). Vendors: [Vite](https://junglewise.ai/threats/vendors/vite).

## Quick answers

**Is CVE-2025-62522 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-62522 being exploited in the wild.

**How severe is CVE-2025-62522?** Medium severity, with a CVSS score of 4, published 20 October 2025.

**Which products and versions are affected?** Vite >=2.9.18,<3.0.0; >=3.2.9,<4.0.0; >=4.5.3,<5.0.0; >=5.2.6,<=5.4.20; >=6.0.0,<=6.4.0; >=7.0.0,<=7.0.7; >=7.1.0,<=7.1.10.

**Is there a fix for CVE-2025-62522?** A patch was published on 2025-10-20: Patches released in versions 5.4.21, 6.4.1, 7.0.8, 7.1.11 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-62522 attacked?** It is attacked over the network.

**Am I affected by CVE-2025-62522?** Check whether you run Vite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a path traversal bypass (CWE-22) affecting Vite's file serving restrictions on Windows. The vulnerability stems from fs.readFile('/foo.png/') loading '/foo.png', which allows an attacker to bypass patterns in server.fs.deny by appending a backslash to the request URL (e.g., /.env\). The attack requires the dev server to be running on Windows and explicitly exposed to the network via --host or server.host configuration. An unauthenticated network attacker can read files that should be denied by default (including .env, .env.*, and certificate/key files). Patches are available in versions 5.4.21, 6.4.1, 7.0.8, and 7.1.11 or later.

## Affected products

- Vite Vite >=2.9.18,<3.0.0; >=3.2.9,<4.0.0; >=4.5.3,<5.0.0; >=5.2.6,<=5.4.20; >=6.0.0,<=6.4.0; >=7.0.0,<=7.0.7; >=7.1.0,<=7.1.10

## Identifiers

- CVE-2025-62522
- GHSA-93m4-6634-74q7

## Timeline

- 2025-10-20: disclosed: Advisory published
- 2025-10-20: patched: Patches released in versions 5.4.21, 6.4.1, 7.0.8, 7.1.11

## References

- [https://github.com/vitejs/vite/security/advisories/GHSA-93m4-6634-74q7](https://github.com/vitejs/vite/security/advisories/GHSA-93m4-6634-74q7)

## Related threats

- [Vite development server file access bypass via query parameters](https://junglewise.ai/threats/cve-2026-118662-vite-is-a-frontend-tooling-framework-for-javascript-from-6-4-4)
- [Vite information disclosure via WebAssembly query parameter](https://junglewise.ai/threats/cve-2026-112947-vite-is-a-frontend-tooling-framework-for-javascript-from-8-2-0)
- [Vite path traversal in transformIndexHtml](https://junglewise.ai/threats/cve-2026-112945-vite-is-a-frontend-tooling-framework-for-javascript-prior-to-6-4)
- [Vitejs launch-editor NTLM hash disclosure via UNC path handling](https://junglewise.ai/threats/cve-2026-53632-vitejs-launch-editor-ntlm-hash-disclosure-via-unc-path-handling)
- [Vite path traversal and sensitive file disclosure on Windows via NTFS ADS](https://junglewise.ai/threats/cve-2026-53571-vite-path-traversal-and-sensitive-file-disclosure-on-windows-via)