CVE-2025-58751— Vite 访问控制错误漏洞
Public Exploits 1
Nuclei · 1 CVE-2025-58751.yaml [template]
Possible ATT&CK Techniques 1AI
T1083 · File and Directory Discovery新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2025-58751の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
Vite middleware may serve files starting with the same name with the public directory
ソース: NVD (National Vulnerability Database)
脆弱性説明
Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public directory were served bypassing the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or `server.host` config option), use the public directory feature (enabled by default), and have a symlink in the public directory are affected. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.
ソース: NVD (National Vulnerability Database)
CVSS情報
N/A
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
对路径名的限制不恰当(路径遍历)
ソース: NVD (National Vulnerability Database)
脆弱性タイトル
Vite 访问控制错误漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Vite是Vite开源的一种新型的前端构建工具。 Vite 7.1.5、7.0.7、6.3.6和5.4.20之前版本存在访问控制错误漏洞，该漏洞源于绕过server.fs设置的文件访问。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
II. CVE-2025-58751の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|---|---|---|
| 1 | Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public directory were served bypassing the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or `server.host` config option), use the public directory feature (enabled by default), and have a symlink in the public directory are affected. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-58751.yaml | POC詳細 |
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2025-58751のインテリジェンス情報
请登录查看更多情报信息。
CVE-2025-58751 厂商安全公告 (1)
IV. 関連脆弱性
同じ製品: vite
- CVE-2026-53571
Vite: `server.fs.deny` bypass on Windows alternate paths - CVE-2026-39365
Vite has a Path Traversal in Optimized Deps `.map` Handling - CVE-2026-39364
Vite has a `server.fs.deny` bypass with queries - CVE-2026-39363
Vite Affected by Arbitrary File Read via Vite Dev Server Web - CVE-2025-62522
vite allows server.fs.deny bypass via backslash on Windows
同じベンダー: vitejs
- CVE-2026-53571
Vite: `server.fs.deny` bypass on Windows alternate paths - CVE-2026-53632
NTLMv2 hash disclosure via UNC path handling on Windows - CVE-2024-52011
launch-editor vulnerable to command injection via the crafte - CVE-2026-39365
Vite has a Path Traversal in Optimized Deps `.map` Handling - CVE-2026-39364
Vite has a `server.fs.deny` bypass with queries
同じ弱点: CWE-22
- CVE-2026-15457
Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to - CVE-2026-15160
Ninja Forms - Excel Export <= 3.3.6 - Missing Authorization - CVE-2026-62229
OpenClaw < 2026.5.18 Authorization Bypass via Glob Matching - CVE-2026-39359
Wazuh: Unauthenticated Path Traversal in authd via Agent Gro - CVE-2026-44177
Kirby: Pre-authentication path traversal and PHP file inclus
V. CVE-2025-58751へのコメント
まだコメントはありません