CVE-2025-62522
MediumPublic exploitvite allows server.fs.deny bypass via backslash on Windows
Published Oct 20, 2025 · Updated Oct 10, 2026 · Also known as GHSA-93m4-6634-74q7, ROOT-APP-NPM-CVE-2025-62522
Key Facts
Routine patching- CVE-2025-62522 is a medium-severity vulnerability (CVSS 6.0 v4) affecting langfuse-2 (chainguard), langfuse-3 (chainguard), langfuse (chainguard) and 7 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 1.1% probability of exploitation in the next 30 days.
- Fixed versions are available, including @seal-security/vite 4.4.11-sp999, langfuse 3.121.0-r0, langfuse-2 2.95.12-r26.
- Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
CVSS v4
6.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (30-day exploit likelihood)
1.1%
Higher than 63.8% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2025-62522 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows. Only apps explicitly exposing the Vite dev server to the network and running the dev server on Windows were affected. This issue has been patched in versions 5.4.21, 6.4.1, 7.0.8, and 7.1.11.
Affected Products
16 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| langfuse-2chainguard | See advisory | 2.95.12-r26 |
| langfuse-3chainguard | See advisory | 3.225.7-r6 |
| langfusechainguard | See advisory | 3.121.0-r0 |
| langfuse-fips-2chainguard | See advisory | 2.95.12-r28 |
| langfuse-fips-3chainguard | See advisory | 3.179.1-r2 |
Patched Releases
@seal-security/vite
4.4.11-sp999
langfuse
3.121.0-r0
langfuse-2
2.95.12-r26
langfuse-3
3.179.1-r3, 3.187.0-r0, 3.225.7-r6
langfuse-fips-2
2.95.12-r28
langfuse-fips-3
3.179.1-r2
librechat
0.8.0-r2
renovate
41.156.1-r0
vite
3.0.0, 4.0.0, 4.4.11-sp999, 5.0.0, 5.4.21, 6.4.1, 7.0.8, 7.1.11
Timeline
Publicly disclosed
Oct 20, 2025
Last updated
Oct 10, 2026
Weakness Type
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
References
- advisoryGHSA advisory
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62522.json
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2025-62522
- articlehttps://github.com/vitejs/vite/commit/f479cc57c425ed41ceb434fecebd63931b1ed4ed
- articlehttps://github.com/vitejs/vite/security/advisories/GHSA-93m4-6634-74q7
FAQ
Common Questions.
Vite is a frontend tooling framework for JavaScript.
Affected: langfuse-2 (chainguard); langfuse-3 (chainguard); langfuse (chainguard), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including @seal-security/vite 4.4.11-sp999, langfuse 3.121.0-r0, langfuse-2 2.95.12-r26.
Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
Is CVE-2025-62522 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo