Vite bypasses server.fs.deny when using `?raw??`
Priority HIGH 72CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure, Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200 and CWE-284.
Summary
Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import&raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.74771 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial vite (vitejs): 4.5.10, 5.4.15, 6.0.12 +2vite (npm): 6.2.3, 6.1.2, 6.0.12 +2Red Hat: 2 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| vitejs | vite | before 4.5.10; 5.0.0 to before 5.4.15; 6.0.0 to before 6.0.12; 6.1.0 to before 6.1.2; 6.2.0 to before 6.2.3 | 4.5.10, 5.4.15, 6.0.12, 6.1.2, 6.2.3 | Patch available | CNA |
| — | vite (npm) | 6.2.0 to before 6.2.3 | 6.2.3 | Patch available | GHSA-x574-m823-4x7w |
| — | vite (npm) | 6.1.0 to before 6.1.2 | 6.1.2 | Patch available | GHSA-x574-m823-4x7w |
| — | vite (npm) | 6.0.0 to before 6.0.12 | 6.0.12 | Patch available | GHSA-x574-m823-4x7w |
| — | vite (npm) | 5.0.0 to before 5.4.15 | 5.4.15 | Patch available | GHSA-x574-m823-4x7w |
| — | vite (npm) | before 4.5.10 | 4.5.10 | Patch available | GHSA-x574-m823-4x7w |
- vite Vendorvitejs Affected before 4.5.10; 5.0.0 to before 5.4.15; 6.0.0 to before 6.0.12; 6.1.0 to before 6.1.2; 6.2.0 to before 6.2.3 Fixed in 4.5.10, 5.4.15, 6.0.12, 6.1.2, 6.2.3 Patch available CNA
- vite (npm) Vendor— Affected 6.2.0 to before 6.2.3 Fixed in 6.2.3 Patch available GHSA-x574-m823-4x7w
- vite (npm) Vendor— Affected 6.1.0 to before 6.1.2 Fixed in 6.1.2 Patch available GHSA-x574-m823-4x7w
- vite (npm) Vendor— Affected 6.0.0 to before 6.0.12 Fixed in 6.0.12 Patch available GHSA-x574-m823-4x7w
- vite (npm) Vendor— Affected 5.0.0 to before 5.4.15 Fixed in 5.4.15 Patch available GHSA-x574-m823-4x7w
- vite (npm) Vendor— Affected before 4.5.10 Fixed in 4.5.10 Patch available GHSA-x574-m823-4x7w
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:* | before 4.5.10; 5.0.0 to before 5.4.15; 6.0.0 to before 6.0.12; 6.1.0 to before 6.1.2; 6.2.0 to before 6.2.3 | Vulnerable | vitejs |
- cpe:2.3:a:vitejs:vite:*:*:*:*:*:node.js:*:* Versions before 4.5.10; 5.0.0 to before 5.4.15; 6.0.0 to before 6.0.12; 6.1.0 to before 6.1.2; 6.2.0 to before 6.2.3 Vulnerable ·vitejs
Remediation
- Fix · CNA vite (vitejs) Fixed in 4.5.10, 5.4.15, 6.0.12, 6.1.2, 6.2.3
- Fix · GHSA-x574-m823-4x7w vite (npm) Fixed in 6.2.3 Advisory →
- Fix · GHSA-x574-m823-4x7w vite (npm) Fixed in 6.1.2 Advisory →
- Fix · GHSA-x574-m823-4x7w vite (npm) Fixed in 6.0.12 Advisory →
- Fix · GHSA-x574-m823-4x7w vite (npm) Fixed in 5.4.15 Advisory →
- Fix · GHSA-x574-m823-4x7w vite (npm) Fixed in 4.5.10 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ansible Automation Platform 2 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift distributed tracing 3 | Affected | No fix yet |
Not affected: 3 products
- Red Hat Ansible Automation Platform 2
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
Timeline
- 2026-10-02 Threatist record created from CVE-2025-30208
- 2026-10-03 Alias added: GHSA-x574-m823-4x7w
References
Patch 5
- https://github.com/vitejs/vite/commit/315695e9d97cc6cfa7e6d9e0229fb50cdae3d9f4
- https://github.com/vitejs/vite/commit/80381c38d6f068b12e6e928cd3c616bd1d64803c
- https://github.com/vitejs/vite/commit/807d7f06d33ab49c48a2a3501da3eea1906c0d41
- https://github.com/vitejs/vite/commit/92ca12dc79118bf66f2b32ff81ed09e0d0bd07ca
- https://github.com/vitejs/vite/commit/f234b5744d8b74c95535a7b82cc88ed2144263c1
More vitejs Vite vulnerabilities
- TI-2025-22386 Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query KEVCVSS 3.1HIGH 7.5
- TI-2026-28350 Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket CVSS 4.0HIGH 8.2
- TI-2023-16938 Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) CVSS 3.1HIGH 7.5
- TI-2026-38634 Vite: `server.fs.deny` bypass on Windows alternate paths CVSS 4.0HIGH 8.2
- TI-2026-28352 Vite has a Path Traversal in Optimized Deps `.map` Handling CVSS 4.0MEDIUM 6.3
- TI-2026-28351 Vite has a `server.fs.deny` bypass with queries CVSS 4.0HIGH 8.2
Sources
- CVE-2025-30208 · CVE Program
- CVE-2025-30208 · NVD
- FIRST EPSS
- GHSA-x574-m823-4x7w · GitHub Advisory Database · CC BY 4.0
- CVE-2025-30208 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences