CVE-2025-31486 PoC — Vite allows server.fs.deny to be bypassed with .svg or relative paths

Source

https://github.com/iSee857/CVE-2025-31486-PoC

Associated Vulnerability

Title: Vite allows server.fs.deny to be bypassed with .svg or relative paths (CVE-2025-31486)
Description:Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than build.assetsInlineLimit (default: 4kB) and when using Vite 6.0+. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 4.5.12, 5.4.17, 6.0.14, 6.1.4, and 6.2.5.

Description

Vite任意文件读取漏洞批量检测脚本CVE-2025-31486

Readme

## 免责申明：

本文所描述的漏洞及其复现步骤仅供网络安全研究与教育目的使用。任何人不得将本文提供的信息用于非法目的或未经授权的系统测试。作者不对任何由于使用本文信息而导致的直接或间接损害承担责任。如涉及侵权，请及时与我们联系，我们将尽快处理并删除相关内容。

## 更多漏洞

https://pc.fenchuan8.com/#/index?forum=101158&yqm=DGR4X

## 复现地址

https://blog.csdn.net/xc_214/article/details/147047575?spm=1001.2014.3001.5501

## 使用方法
```
#不携带payload默认检测linux和windows默认路径
#携带payload走自定义路径
批量检测：
python poc.py -f url.txt -t 5 -p <payload> -o <outPutFile> --proxy
单个检测：
python poc.py -u http://your-ip -t 5 -p <payload> -o <outPutFile> --proxy
```

![image](https://github.com/user-attachments/assets/8fd15ec4-4867-4c3c-9511-df09ba72aa07)
![image](https://github.com/user-attachments/assets/b2579ab8-cbf3-492a-ac86-9bf607a8ff48)


## 参考链接
https://github.com/vitejs/vite/security/advisories/GHSA-xcj6-pq6g-qj4x

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →