--- id: "CVE-2025-31125" kind: "vulnerability" aliases: ["CVE-2025-31125"] title: "vitejs vite: Vite is a frontend tooling framework for javascript" severity: "high" cvss: 7.5 epss: null exploited: true status: "open" category: "package" products: [{"name": "Vite Vitejs", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "vitejs vite", "fixed": ["4.5.11"], "affected": "< 4.5.11", "ecosystem": "vendor"}, {"name": "vitejs vite", "fixed": ["5.4.16"], "affected": ">= 5.0.0, < 5.4.16", "ecosystem": "vendor"}, {"name": "vitejs vite", "fixed": ["6.0.13"], "affected": ">= 6.0.0, < 6.0.13", "ecosystem": "vendor"}, {"name": "vitejs vite", "fixed": ["6.1.3"], "affected": ">= 6.1.0, < 6.1.3", "ecosystem": "vendor"}, {"name": "vitejs vite", "fixed": ["6.2.4"], "affected": ">= 6.2.0, < 6.2.4", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["cloudflare", "dev-server", "exploited", "javascript", "lab-disclosure", "package", "self-hosted", "vite"] not_affected_if: ["default-config", "localhost-only", "production-build-only"] published_at: "2025-03-31T17:15:43+00:00" first_seen_at: "2026-10-23T19:11:51+00:00" updated_at: "2026-10-24T19:12:57+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31125", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31125", "first_seen_at": "2026-10-23T23:44:51+00:00"}, {"source": "lab", "url": "https://developers.cloudflare.com/changelog/post/2026-02-16-waf-release/", "first_seen_at": "2026-10-24T19:12:57+00:00"}] --- # vitejs vite: Vite is a frontend tooling framework for javascript Vite, a JavaScript build tool, has an access control flaw where its dev server exposes the contents of files it should block when a request uses ?inline&import or ?raw?import. An attacker who can reach the dev server can read those files, which can include secrets or source code. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Vite Vitejs affected ? fixed ? - vendor:vitejs vite affected < 4.5.11 fixed 4.5.11 - vendor:vitejs vite affected >= 5.0.0, < 5.4.16 fixed 5.4.16 - vendor:vitejs vite affected >= 6.0.0, < 6.0.13 fixed 6.0.13 - vendor:vitejs vite affected >= 6.1.0, < 6.1.3 fixed 6.1.3 - vendor:vitejs vite affected >= 6.2.0, < 6.2.4 fixed 6.2.4 ## How to check Check whether the dev server is started with --host or sets server.host in vite.config; if it is not, the project is not exposed. Confirm the installed Vite version with: npx vite --version ## Fix Upgrade Vite to a patched release from the vendor's advisory; the sources do not name the fixed version. Do not run the dev server on a network interface; bind it to localhost or discontinue exposing it. ## Mitigated for you by - Cloudflare (waf-rule, since 2026-02-16): covers HTTP requests proxied through Cloudflare matching the Vite WASM import path traversal pattern (CVE-2025-31125), via Cloudflare Managed Ruleset rule ...950ed8c8 Limits: Traffic not proxied through Cloudflare; rule action changed from Log to Block; coverage beyond the rule's detection pattern is not stated Still: none stated; the document does not say customers must patch Vite https://developers.cloudflare.com/changelog/post/2026-02-16-waf-release/ ## Timeline - 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-31125 - 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-31125 - 2026-10-24T19:12:57+00:00 lab https://developers.cloudflare.com/changelog/post/2026-02-16-waf-release/ — Cloudflare: WAF Release - 2026-02-16 · Changelog ## Documents - [advisory] Cloudflare: WAF Release - 2026-02-16 · Changelog https://developers.cloudflare.com/changelog/post/2026-02-16-waf-release/ ## From the sources WAF Release - 2026-02-16 · Changelog # Changelog New updates and improvements at Cloudflare. February 16, 2026 ## WAF Release - 2026-02-16 This week’s release introduces new detections for CVE-2025-68645 and CVE-2025-31125. Key Findings - CVE-2025-68645: A Local File Inclusion (LFI) vulnerability in the Webmail Classic UI of Zimbra Collaboration Suite (ZCS) 10.0 and 10.1 allows unauthenticated remote attackers to craft requests to the `/h/rest` endpoint, improperly influence internal dispatching, and include arbitrary files from the WebRoot directory. - CVE-2025-31125: Vite, the JavaScript frontend tooling framework, exposes content of non-allowed files via `?inline&import` when its development server is network-exposed, enabling unauthorized attackers to read arbitrary files and potentially leak sensitive information. | Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments | | --- | --- | --- | --- | --- | --- | --- | | Cloudflare Managed Ruleset | ...833761f7 | N/A | Zimbra - Local File Inclusion - CVE:CVE-2025-68645 | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...950ed8c8 | N/A | Vite - WASM Import Path Traversal - CVE:CVE-2025-31125 | Log | Block | This is a new detection. | --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_