CVE-2025-30208: Vite File Disclosure Vulnerability

CVE-2025-30208 Overview

Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. @fs denies access to files outside of Vite serving allow list. Adding ?raw?? or ?import&raw?? to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as ? are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue.

Critical Impact
This vulnerability allows unauthorized access to sensitive files, potentially leading to information disclosure.

Affected Products

vitejs vite
Not Available
Not Available

Discovery Timeline

Not Available - Vulnerability discovered by Not Available
Not Available - Responsible disclosure to vitejs
Not Available - CVE CVE-2025-30208 assigned
Not Available - vitejs releases security patch
2025-03-24T17:15:21.820 - CVE CVE-2025-30208 published to NVD
2025-09-23T14:39:29.023 - Last updated in NVD database

Technical Details for CVE-2025-30208

Vulnerability Analysis

The vulnerability stems from the ability to bypass @fs path restrictions by appending query separators such as ?raw??, allowing unauthorized retrieval of file contents from outside the allowed paths. This can lead to the unintended exposure of sensitive data if the Vite dev server is exposed to the network.

Root Cause

Trailing separators like ? are not properly accounted for in regular expressions that validate URLs, leading to bypasses of path restrictions.

Attack Vector

Network-based attackers can exploit this vulnerability by sending crafted URLs with specific query parameters to dev servers exposed with --host or server.host.

javascript

// Example exploitation code (sanitized)
fetch('http://vulnerable-site.local/@fs/sensitive-file.txt?raw??')
  .then(response => response.text())
  .then(data => console.log(data));

Detection Methods for CVE-2025-30208

Indicators of Compromise

Unusual access logs with ?raw?? or ?import&raw??
Unexplained file access patterns
Unexpected sensitive data exposure

Detection Strategies

Monitoring server logs for suspicious URL patterns and conducting regular checks for unauthorized access attempts can help in early detection of exploitation attempts.

Monitoring Recommendations

Implement network-based intrusion detection systems (NIDS) to watch for crafted URLs containing query bypass patterns. Use SentinelOne’s endpoint protection platform to monitor and block unauthorized network connections.

How to Mitigate CVE-2025-30208

Immediate Actions Required

Update Vite to versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, or 4.5.10
Restrict network exposure of the Vite dev server
Monitor and review access logs for suspicious activity

Patch Information

Patches are available at:

Workarounds

Configure your server to restrict network exposure of the Vite dev server using firewall rules.

bash

# Configuration example
iptables -A INPUT -p tcp --dport 3000 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 3000 -j DROP