medium CVSS 5.3 EPSS 75% Public exploit available

CVE-2025-30208·Vite vulnerability

Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import&raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue.

Severity
medium
Software
Vite
Fixed in
6.2.3
Published

How Defensia detected this

Defensia agents read the web server logs of the Linux servers they protect and match incoming requests against exploitation signatures. When the same CVE is matched across enough independent servers, from enough distinct networks, it is recorded as being actively exploited. That threshold was crossed for CVE-2025-30208 starting , across 35% of the servers Defensia monitors, from 182 distinct attacking IP addresses.

Every CVE we currently measure under active exploitation is listed together, with the share of servers targeted and how long each has been running.

Where the attacks came from

US · 1475DE · 559ES · 362BR · 284BE · 224

Aggregated across every server Defensia monitors, over 52 days of observation, last measured . Counts are of distinct servers and distinct source addresses, not of requests. No customer, host or domain is identified.

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 75% — in the top 0.5% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

From: 6.2.0

Until: 6.2.3

Fixed in: 6.2.3

How to fix this CVE

Update Vite to version 6.2.3 or later to patch the @fs access control bypass. If you are running Vite dev server with network exposure (--host flag or server.host configuration), immediately upgrade to prevent unauthorized file disclosure. The vulnerability allows attackers to read arbitrary files by appending query string manipulations to bypass security filters.

sudo dnf update vite

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

(?:[?&](?:raw|import)[?&]*){2,}|\?raw\?\?|\?import&raw\?\?

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch. 

Implement request filtering to block URLs containing patterns like '?raw??', '?import&raw??', or consecutive query separators ('??') targeting Vite dev server endpoints. Block requests where path traversal indicators appear with redundant query parameters.

How to check if you are affected

  1. Step 1: Check Vite version with 'npm list vite' or 'yarn list vite' in your project directory
  2. Step 2: Verify if Vite dev server is exposed to network by checking for '--host' flag in package.json scripts or 'server.host' in vite.config.js
  3. Step 3: Search dev server logs for requests containing patterns like '?raw??' or '?import&raw??' followed by file paths
  4. Step 4: After upgrading to 6.2.3+, restart the Vite dev server and confirm version with 'npm list vite' returns the patched version

Indicators of compromise

  • URL pattern: /?raw??<filepath>
  • URL pattern: /?import&raw??<filepath>
  • User-Agent patterns accessing Vite dev server with query string bypasses

FAQ

What is CVE-2025-30208?

CVE-2025-30208 is a query string bypass vulnerability in Vite's @fs file access control mechanism. Attackers can append trailing separators like ?raw?? or ?import&raw?? to URLs to read files outside the intended serving allowlist when the dev server is exposed to the network.

Is CVE-2025-30208 being actively exploited?

While not currently listed in the CISA KEV catalog, public exploits are available (Exploit-DB #52111), making this vulnerability actively exploitable if Vite dev servers are exposed to untrusted networks.

What versions of Vite are affected by CVE-2025-30208?

Versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 are affected. If you are on version 6.2.0-6.2.2, 6.1.0-6.1.1, 6.0.0-6.0.11, 5.4.0-5.4.14, or 4.5.0-4.5.9, your installation is vulnerable.

How do I check if my server is vulnerable to CVE-2025-30208?

Run 'npm list vite' to see your installed version and compare against the patched versions listed above. Then check your Vite configuration for network exposure with 'grep -r "server.host\|--host" vite.config.js package.json'.

Does Defensia detect CVE-2025-30208?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Vite is installed on a monitored server, CVE-2025-30208 will appear in your dashboard with remediation steps.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2025-30208. Free for 1 server.

Get started free