Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-q59b-2z2s-mfbt
Vulnerability ID VCID-q59b-2z2s-mfbt
Aliases CVE-2025-31486
GHSA-xcj6-pq6g-qj4x
Summary Vite allows server.fs.deny to be bypassed with .svg or relative paths The contents of arbitrary files can be returned to the browser.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-284 Improper Access Control
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 5.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-31486.json
epss 0.04736 https://api.first.org/data/v1/epss?cve=CVE-2025-31486
cvssv3.1 5.3 https://github.com/vitejs/vite
generic_textual MODERATE https://github.com/vitejs/vite
cvssv3.1 5.3 https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290
generic_textual MODERATE https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290
ssvc Track https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290
cvssv3.1 5.3 https://github.com/vitejs/vite/commit/62d7e81ee189d65899bb65f3263ddbd85247b647
generic_textual MODERATE https://github.com/vitejs/vite/commit/62d7e81ee189d65899bb65f3263ddbd85247b647
ssvc Track https://github.com/vitejs/vite/commit/62d7e81ee189d65899bb65f3263ddbd85247b647
cvssv3.1 5.3 https://github.com/vitejs/vite/security/advisories/GHSA-xcj6-pq6g-qj4x
generic_textual MODERATE https://github.com/vitejs/vite/security/advisories/GHSA-xcj6-pq6g-qj4x
ssvc Track https://github.com/vitejs/vite/security/advisories/GHSA-xcj6-pq6g-qj4x
cvssv3.1 5.3 https://nvd.nist.gov/vuln/detail/CVE-2025-31486
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2025-31486
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-31486.json
https://api.first.org/data/v1/epss?cve=CVE-2025-31486
https://github.com/vitejs/vite
https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290
https://github.com/vitejs/vite/commit/62d7e81ee189d65899bb65f3263ddbd85247b647
2357264 https://bugzilla.redhat.com/show_bug.cgi?id=2357264
CVE-2025-31486 https://nvd.nist.gov/vuln/detail/CVE-2025-31486
GHSA-xcj6-pq6g-qj4x https://github.com/advisories/GHSA-xcj6-pq6g-qj4x
GHSA-xcj6-pq6g-qj4x https://github.com/vitejs/vite/security/advisories/GHSA-xcj6-pq6g-qj4x
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-31486.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N Found at https://github.com/vitejs/vite
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N Found at https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-03T20:39:24Z/ Found at https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N Found at https://github.com/vitejs/vite/commit/62d7e81ee189d65899bb65f3263ddbd85247b647
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-03T20:39:24Z/ Found at https://github.com/vitejs/vite/commit/62d7e81ee189d65899bb65f3263ddbd85247b647
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N Found at https://github.com/vitejs/vite/security/advisories/GHSA-xcj6-pq6g-qj4x
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-03T20:39:24Z/ Found at https://github.com/vitejs/vite/security/advisories/GHSA-xcj6-pq6g-qj4x
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2025-31486
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.89613
EPSS Score 0.04736
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-04T16:23:45.381137+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/vite/CVE-2025-31486.yml 38.6.0