Vite - Information Disclosure (CVE-2025-30208)
2512Exploiting IPs reported
Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import&raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue.
CrowdSec analysis
CVE-2025-30208 is a vulnerability in Vite frontend development tooling that allows attackers to bypass file access restrictions by manipulating URL query strings, potentially exposing the contents of arbitrary files to the browser. This flaw can be exploited remotely if the Vite dev server is exposed to the network, posing a risk of sensitive data disclosure through crafted requests.
CrowdSec has been tracking this vulnerability and its exploits since 1st of October 2025.
CrowdSec network data shows that most actors exploiting CVE-2025-30208 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. In addition, according to the CrowdSec network, attack volume against CVE-2025-30208 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.
Attackers exploit this vulnerability by requesting files with paths like /@fs/etc/passwd?raw or /@fs/C:/Windows/System32/drivers/etc/hosts?raw, using the ?raw query to bypass Vite's file access restrictions and read arbitrary files from the server. Targets are typically Vite dev servers exposed to the network.
Exploitation
Get real-time information about exploitation attempts and actors involved.
Protection
Find out relevant information to protect your stack against this CVE.
Blocklist
With our advanced worldwide network detection, CrowdSec can provide a list of IPs known for exploiting the vulnerability.
To increase your protection against this CVE, block exploitation attempts with this list of identified actors.