CVE-2025-58752

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-58752
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-58752.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-58752
Aliases
Downstream
Related
Published
2025-09-08T22:56:58.039Z
Modified
2025-11-28T02:34:16.934239Z
Severity
  • 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Vite's `server.fs` settings were not applied to HTML files
Details

Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, any HTML files on the machine were served regardless of the server.fs settings. Only apps that explicitly expose the Vite dev server to the network (using --host or server.host config option) and use appType: 'spa' (default) or appType: 'mpa' are affected. This vulnerability also affects the preview server. The preview server allowed HTML files not under the output directory to be served. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58752.json",
    "cwe_ids": [
        "CWE-200",
        "CWE-23",
        "CWE-284"
    ]
}
References

Affected packages

Git / github.com/vitejs/vite

Affected ranges

Type
GIT
Repo
https://github.com/vitejs/vite
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
997700f01c7199daf7330d33a7fd3a43b2e9e3ba
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.4.20"
        }
    ]
}
Type
GIT
Repo
https://github.com/vitejs/vite
Events
Introduced
814120f2ad387ca3d1e16c7dd403b04ca4b97f75
Fixed
3f337c5e24504e51188d29c970de1416ee523dbb
Database specific 
{
    "versions": [
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.3.6"
        }
    ]
}
Type
GIT
Repo
https://github.com/vitejs/vite
Events
Introduced
b85f32275b443bf6b647572a9209f1e078b5b4dd
Fixed
f88a1c0999f4f0d8efc42810f27dff5aa30ad680
Database specific 
{
    "versions": [
        {
            "introduced": "7.0.0"
        },
        {
            "fixed": "7.0.7"
        }
    ]
}
Type
GIT
Repo
https://github.com/vitejs/vite
Events
Introduced
931684ef1ea8b120fcc2f1f2b001b8d24d85daa7
Fixed
564754061e9494f355370e31ee9d7ea5abef6037
Database specific 
{
    "versions": [
        {
            "introduced": "7.1.0"
        },
        {
            "fixed": "7.1.5"
        }
    ]
}