Vite - Information Disclosure (CVE-2025-30208)
Description
Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. @fs denies access to files outside of Vite serving allow list. Adding ?raw?? or ?import&raw?? to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as ? are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue.
psychologyCrowdSec Analysis
CVE-2025-30208 is a vulnerability in Vite frontend development tooling that allows attackers to bypass file access restrictions by manipulating URL query strings, potentially exposing the contents of arbitrary files to the browser. This flaw can be exploited remotely if the Vite dev server is exposed to the network, posing a risk of sensitive data disclosure through crafted requests.
CrowdSec has been tracking this vulnerability and its exploits since 1st of October 2025.
CrowdSec network data shows that most actors exploiting CVE-2025-30208 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. CrowdSec data also reveals a clear uptick in attacks involving CVE-2025-30208 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.
Attackers exploit this vulnerability by requesting files with paths like /@fs/etc/passwd?raw or /@fs/C:/Windows/System32/drivers/etc/hosts?raw, using the ?raw query to bypass Vite's file access restrictions and read arbitrary files from the server. Targets are typically Vite dev servers exposed to the network.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2025-03-24 |
| Rule Released | 2025-10-01 |
| CrowdSec First Seen | 2025-10-02 |
Related Weaknesses
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Remediation & Protection
External References
- https://github.com/vitejs/vite/commit/315695e9d97cc6cfa7e6d9e0229fb50cdae3d9f4
- https://github.com/vitejs/vite/security/advisories/GHSA-x574-m823-4x7w
- https://github.com/vitejs/vite/commit/80381c38d6f068b12e6e928cd3c616bd1d64803c
- https://github.com/vitejs/vite/commit/f234b5744d8b74c95535a7b82cc88ed2144263c1
- https://github.com/vitejs/vite/commit/807d7f06d33ab49c48a2a3501da3eea1906c0d41
- https://github.com/vitejs/vite/commit/92ca12dc79118bf66f2b32ff81ed09e0d0bd07ca
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-30208.yaml