CVE-2025-31125 PoC — Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query

Source

Associated Vulnerability

Description

Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.

Readme

**Vite Exploit (CVE-2025-31125)**

Description: Exploits path traversal in Vite Development Server's @fs endpoint (CVE-2025-31125) to access sensitive files like /etc/passwd and /etc/hosts via crafted URLs. 

Created by Harsh Gupta.

**Usage:**
python vite_exploit.py -u http://target.com
python vite_exploit.py -f urls.txt -o output.txt



Requirements:

Python 3.x
pip install requests colorama

**Disclaimer:** This tool is for educational purposes and authorized security testing only. The author is not responsible for any misuse or damage caused by this script. Use at your own risk.
Warning: Use with permission only. Unauthorized testing is illegal.
License: MIT

File Snapshot

 [4.0K]  /data/pocs/84c8243d0d6c69030df1f7ceb3ae454aef327935
├── [5.9K]  exploit.py
└── [ 671]  README.md

0 directories, 2 files

Remarks