Security Research

CVE-2025-32395 Vite Dev Server Path Traversal: # Character Bypass of server.fs.deny

Thinking 2025-04-15 6 min read Research Dossier
#Vulnerability Analysis#Code Audit#Web Security
CVE-2025-32395 Vite Dev Server Path Traversal: # Character Bypass of server.fs.deny

Vite Dev Server’s server.fs.deny middleware uses regex matching on the URL to refuse access to files outside the project directory — but the # character per RFC 9112/9113 should only be used as a URL fragment, while Node.js by default allows # in the path. Attackers use this difference to craft /src/safe.txt#/../../../unsafe.txt, so fs.deny sees /src/safe.txt (in whitelist) but the filesystem actually accesses unsafe.txt (outside whitelist).

Unlock to view this content.