# CVE-2025-30208: Vite - Information Disclosure

> Live exploitation tracking for CVE-2025-30208 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-30208

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 5.3
- **Public exploit available:** Yes
- **Affected products:** Vitejs Vite
- **Weaknesses:** CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor); CWE-284 (Improper Access Control)
- **Tags:** web_application, javascript

## Description

Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import&raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue.

## CrowdSec analysis

[CVE-2025-30208](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-30208) is a vulnerability in Vite frontend development tooling that allows attackers to bypass file access restrictions by manipulating URL query strings, potentially exposing the contents of arbitrary files to the browser. This flaw can be exploited remotely if the Vite dev server is exposed to the network, posing a risk of sensitive data disclosure through crafted requests.

CrowdSec has been tracking this vulnerability and its exploits since 1st of October 2025.

CrowdSec network data shows that most actors exploiting CVE-2025-30208 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature.
CrowdSec data also reveals a clear uptick in attacks involving CVE-2025-30208 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Attackers exploit this vulnerability by requesting files with paths like `/@fs/etc/passwd?raw` or `/@fs/C:/Windows/System32/drivers/etc/hosts?raw`, using the `?raw` query to bypass Vite's file access restrictions and read arbitrary files from the server. Targets are typically Vite dev servers exposed to the network.

## Timeline

- 2025-03-24: CVE Published. CVE-2025-30208 is published to NVD.
- 2025-10-01: Rule Released. CrowdSec releases a rule to detect CVE-2025-30208 exploitation attempts against the CrowdSec Network.
- 2025-10-02: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-30208 for the first time.

## References

- https://github.com/vitejs/vite/commit/315695e9d97cc6cfa7e6d9e0229fb50cdae3d9f4
- https://github.com/vitejs/vite/security/advisories/GHSA-x574-m823-4x7w
- https://github.com/vitejs/vite/commit/80381c38d6f068b12e6e928cd3c616bd1d64803c
- https://github.com/vitejs/vite/commit/f234b5744d8b74c95535a7b82cc88ed2144263c1
- https://github.com/vitejs/vite/commit/807d7f06d33ab49c48a2a3501da3eea1906c0d41
- https://github.com/vitejs/vite/commit/92ca12dc79118bf66f2b32ff81ed09e0d0bd07ca
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-30208.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-30208) follows observed exploitation activity for CVE-2025-30208. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.