Patchfirst
Patchfirst
CVE-2025-30208 Public exploit Medium · 5.3 EPSS 74.8%

Vite bypasses server.fs.deny when using `?raw??`

vitejs · vite

Summary

Vite's dev server, the frontend tooling's development server, fails to enforce its server.fs.deny file-access restrictions when a request URL includes a trailing ?raw?? or ?import&raw?? query string, because trailing separators are stripped in several places but not handled in the query string regexes. An attacker who can reach a Vite dev server that has been explicitly exposed to the network (via --host or the server.host option) and can get a victim to interact with a crafted link or page can retrieve the contents of arbitrary files on the server.

Official description · CVE.org

Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import&raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue.

Breakdown
65.2 / 100
Exploited
Yes, in VulnCheck KEV
Reports
0
Tactics
0/15

First seen exploited 35 days after disclosure. Public exploit code (PoC-in-GitHub) appeared 2 days after disclosure.

  1. Disclosedday 0
  2. Public exploit codePoC-in-GitHub+2 days
  3. First seen exploitedVulnCheck KEV evidence+35 days

See the family tree

9 related vulnerabilities in the same code over 19 months. The latest fix listed for vite is 6.2.6.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. CVE-2024-45811server.fs.deny bypassed when using ?import&raw in vite17 Sep 2024
  2. relatedMedium

    Why these are linked:

    This CVECVE-2025-30208Vite bypasses server.fs.deny when using `?raw??`24 Mar 2025
  3. relatedHigh

    Why these are linked:

    • Fixed one release later6.2.3 → 6.2.4 (vite)
    • Fixed one release later4.5.10 → 4.5.11 (vite)
    • Same code patched: transform.ts, index.html (machine-matched)Functions: transformMiddlewarecommit 315695ecommit 80381c3commit 5967313
    • Similar weakness in the same product (machine-matched)same package + description similarity
    CVE-2025-31125Vite Vitejs Improper Access Control31 Mar 2025KEV
  4. relatedMedium

    Why these are linked:

    CVE-2026-39364Vite has a `server.fs.deny` bypass with queries7 Apr 2026
  5. relatedMedium

    Why these are linked:

    CVE-2026-39365Vite has a Path Traversal in Optimized Deps `.map` Handling7 Apr 2026

4 more CVEs are in this family. See the family tree

Fixes in vitenpm package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 5.4.6CVE-2024-4581217 Sep 2024
  2. 5.4.9CVE-2024-520111 Jun 2026
  3. 6.0.9CVE-2025-2401020 Jan 2025
  4. 6.2.3CVE-2025-3020824 Mar 2025
  5. 6.2.4CVE-2025-3112531 Mar 2025KEV
  6. 6.2.5CVE-2025-314863 Apr 2025
  7. 6.2.6CVE-2025-3239510 Apr 2025Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: vite.

npmviteGHSA-x574-m823-4x7w

Upgrade to 6.4.2 or later

Fixes this CVE and 2 other known vulnerabilities in this package (CVE-2025-31125, CVE-2026-39365).

npmnpm install vite@6.4.2

First fixed in 6.2.3 for CVE-2025-30208.

Affected versions, by release line

If you runUpgrade to
6.2.0 up to 6.2.36.4.2first fix for this CVE: 6.2.3
6.1.0 up to 6.1.2

Still affected on this line by CVE-2026-39365 (fixed in 6.4.2, a newer line).

6.1.3first fix for this CVE: 6.1.2
6.0.0 up to 6.0.12

Still affected on this line by CVE-2026-39365 (fixed in 6.4.2, a newer line).

6.0.13first fix for this CVE: 6.0.12
5.0.0 up to 5.4.15

Still affected on this line by CVE-2026-39365 (fixed in 6.4.2, a newer line).

5.4.16first fix for this CVE: 5.4.15
All versions before 4.5.10

Still affected on this line by CVE-2026-39365 (fixed in 6.4.2, a newer line).

4.5.11first fix for this CVE: 4.5.10

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 4 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

6 links, grouped by NVD tag

x_refsource_CONFIRM 1

github.com/vitejs/vite/security/advisories/GHSA-x574-m823-4x7w

x_refsource_MISC 5

github.com/vitejs/vite/commit/315695e9d97cc6cfa7e6d9e0229fb50cdae3d9f4github.com/vitejs/vite/commit/80381c38d6f068b12e6e928cd3c616bd1d64803cgithub.com/vitejs/vite/commit/807d7f06d33ab49c48a2a3501da3eea1906c0d41github.com/vitejs/vite/commit/92ca12dc79118bf66f2b32ff81ed09e0d0bd07cagithub.com/vitejs/vite/commit/f234b5744d8b74c95535a7b82cc88ed2144263c1
↑ ↓ chooseEnter openEsc close