Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query

🗓️ 31 Mar 2025 17:31:54Reported by GitHub Advisory DatabaseType

Vite server.fs.deny bypassed allowing file content exposure via inline and raw queries.

Reporter	Title	Published	Views	Family All 43
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in Vite affect IBM Robotic Process Automation (CVE-2025-31125, CVE-2025-32395, CVE-2025-31486).	16 Jun 202522:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Manage Component uses vite-5.4.12.tgz which is vulnerable to CVE-2025-31125	27 Jun 202512:09	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Concert Software.	18 Aug 202504:29	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM watsonx Code Assistant IDE Extensions	28 Aug 202515:51	–	ibm
GithubExploit	Exploit for CVE-2025-31125	13 Jul 202516:42	–	githubexploit
GithubExploit	Exploit for CVE-2025-30208	24 Apr 202510:53	–	githubexploit
GithubExploit	Exploit for CVE-2025-31125	12 Sep 202522:20	–	githubexploit
GithubExploit	Exploit for CVE-2025-30208	31 Mar 202513:43	–	githubexploit
GithubExploit	Exploit for CVE-2025-30208	26 Mar 202510:26	–	githubexploit
GithubExploit	Exploit for CVE-2025-31125	7 May 202507:45	–	githubexploit

Vulners

Node

vitejs viteRange<4.5.11npm

vitejs viteRange5.0.0–5.4.16npm

vitejs viteRange6.0.0–6.0.13npm

vitejs viteRange6.1.0–6.1.3npm

vitejs viteRange6.2.0–6.2.4npm

Source	Link
github	www.github.com/vitejs/vite/security/advisories/GHSA-4r4m-qw57-chr8
github	www.github.com/vitejs/vite/commit/59673137c45ac2bcfad1170d954347c1a17ab949
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-31125
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog
github	www.github.com/advisories/GHSA-4r4m-qw57-chr8

22 Jan 2026 21:47Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.15.3 - 7.5

EPSS0.83244

SSVC