Path Traversal in Sapphi-Red Vite-Plugin-Static-Copy

CVE-2025-57753

vite-plugin-static-copy is rollup-plugin-copy for Vite with dev server support. Files not included in src are accessible with a crafted request. The vulnerability is fixed in 2.3.2 and 3.1.2.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.004 (35.4th percentile) — read the EPSS interpretation.

Affected products

Sapphi-red Vite-plugin-static-copy — versions >= 3.0.0, < 3.1.2, >= 0.4.3, < 2.3.2

Weakness classification (CWE)

CWE-22 — Path Traversal

References

security-advisories@github.com (x_refsource_CONFIRM)