CVE-2025-31125 PoC — Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query

Source

https://github.com/nak000/Vitejs-exploit-CVE-2025-31125-rce

Associated Vulnerability

Title:Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query (CVE-2025-31125)
Description:Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.

Readme

**Vite Exploit (CVE-2025-31125)**

Description: Exploits path traversal in Vite Development Server's @fs endpoint (CVE-2025-31125) to access sensitive files like /etc/passwd and /etc/hosts via crafted URLs. 

Created by Muhammad Waseem.

**Usage:**
python vite_exploit.py -u http://target.com
python vite_exploit.py -f urls.txt -o output.txt

![image](https://github.com/user-attachments/assets/a3f3caf7-d487-4db0-a7e0-29a0e6e3c410)

![image](https://github.com/user-attachments/assets/62f056a7-6eef-4f49-80e2-183320c5fcc9)

Requirements:

Python 3.x
pip install requests colorama

**Disclaimer:** This tool is for educational purposes and authorized security testing only. The author is not responsible for any misuse or damage caused by this script. Use at your own risk.
Warning: Use with permission only. Unauthorized testing is illegal.
License: MIT

File Snapshot


 [4.0K]  /data/pocs/9b39728b070c55fcb58dfbf09cb226f72c2c870c
├── [5.9K]  exploit.py
└── [ 855]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!