← CVE Intelligence

CVE-2025-57753

vite-plugin-static-copy files not included in `src` are accessible with a crafted request PUBLISHED

Description (CNA)

vite-plugin-static-copy is rollup-plugin-copy for Vite with dev server support. Files not included in src are accessible with a crafted request. The vulnerability is fixed in 2.3.2 and 3.1.2.

Affected (CNA)

Vendor / productVersions
sapphi-red / vite-plugin-static-copyaffected >= 3.0.0, < 3.1.2; affected >= 0.4.3, < 2.3.2

CWE

CWE-22

References

ADP enrichment

CISA-ADP

No English description supplied.