CVE-2025-58751
Fixed in a distro release EPSS 1%CVSS 2.3
Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public directory were served bypassing the `server.fs` settings. Only apps that explicitly expose the Vite dev server to the network (using --host or `server.host` config option), use the public directory feature (enabled by default), and have a symlink in the public directory are affected. Versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 fix the issue.
Products: vitejs vite
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | vite | 7.1.5 |
| npm | vite | 7.0.7 |
| npm | vite | 6.3.6 |
| npm | vite | 5.4.20 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | gitlab-rails-ce-18.1 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.1 | no fix |
| Chainguard | langfuse-2-worker | 2.95.12-r26 |
| Chainguard | langfuse-3-compat | 3.225.7-r6 |
| Chainguard | langfuse-3-worker | 3.179.1-r3 |
| Chainguard | langfuse-fips-2-worker | 2.95.12-r28 |
| Chainguard | langfuse-fips-3-worker | 3.179.1-r2 |
| Chainguard | vitess-21 | no fix |
| Chainguard | vitess-22 | 22.0.2-r0 |
| Chainguard | vitess-22 | 22.0.1-r7 |
| Chainguard | vitess-23 | 23.0.0-r2 |
| Chainguard | vitess-23-binaries | 23.0.0-r2 |
| Chainguard | vitess-23-compat | 23.0.0-r2 |
| Wolfi | langfuse-3-compat | 3.225.7-r6 |
| Wolfi | langfuse-3-worker | 3.179.1-r3 |
| Wolfi | vitess-23 | 23.0.0-r2 |
| Wolfi | vitess-23-binaries | 23.0.0-r2 |
| Wolfi | vitess-23-compat | 23.0.0-r2 |