Path Traversal in Sapphi-Red Vite-Plugin-Static-Copy
CVE-2025-57753
vite-plugin-static-copy is rollup-plugin-copy for Vite with dev server support. Files not included in src are accessible with a crafted request. The vulnerability is fixed in 2.3.2 and 3.1.2.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
EPSS exploit prediction
EPSS: 0.004 (34.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 34th percentile — 34.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Sapphi-Red Vite-Plugin-Static-Copy — versions >= 3.0.0, < 3.1.2, >= 0.4.3, < 2.3.2