CVE-2025-31125: Vite dev server improper access control exposes arbitrary files

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is remotely reachable without authentication and is in CISA KEV with high EPSS, but impact is limited to information disclosure and only affects dev servers explicitly exposed to the network.

What it is

Vite's dev server fails to restrict file access when a request uses the ?inline&import or ?raw?import query patterns, allowing content of files that should not be served to be read. Only deployments that explicitly expose the dev server to the network via --host or server.host are affected, so the risk is concentrated in development or exposed-dev environments rather than default local-only setups.

Impact

An unauthenticated remote attacker can read files outside the intended allowlist from the exposed dev server, leading to disclosure of source code, configuration and potentially secrets present on the host.

Attack surface

Reached over the network via HTTP requests to the Vite dev server; the CVSS vector shows no privileges or user interaction required, but exploitation depends on the server being bound to a network interface through --host or server.host.

Exploitation

CVE-2025-31125 is listed in CISA KEV with a due date of 2026-02-12, and EPSS shows a 30-day probability of 0.58462 (99th percentile); the vendor advisory is tagged Exploit, indicating public exploit information exists. No ransomware campaign use is documented.

What to do

• Upgrade Vite to a fixed release: 6.2.4, 6.1.3, 6.0.13, 5.4.16 or 4.5.11, matching your major version line.
• Stop exposing the Vite dev server to untrusted networks; remove --host and server.host settings unless strictly required.
• If remote access is required, place the dev server behind authentication and network allowlisting rather than binding it openly.
• Audit exposed dev servers for sensitive files (env files, keys, source) and rotate any credentials that may have been readable.

Detection

• Monitor HTTP requests to Vite dev server endpoints containing ?inline&import or ?raw?import query patterns.
• Alert on Vite dev server processes bound to non-loopback addresses (--host or server.host configured).
• Review network logs for external access to development ports commonly used by Vite (for example 5173) from untrusted sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.