# CVE-2025-30208: Vite access control bypass in server.fs.deny with query parameters

Source: https://junglewise.ai/threats/cve-2025-30208-vite-access-control-bypass-in-server-fs-deny-with-query  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-03-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-30208 · Severity: low · CVSS 3.1 · Published 2025-03-25

Vite is a popular JavaScript build tool and development server used to build web applications. When a developer explicitly exposes the Vite dev server to the network, attackers can craft malicious URLs with specific query parameters to read arbitrary files from the host system, bypassing intended file access restrictions. This could expose sensitive source code, configuration files, or other confidential data to unauthorized parties.

Technologies: [Vite](https://junglewise.ai/threats/technologies/vite). Vendors: [Vite](https://junglewise.ai/threats/vendors/vite).

## Quick answers

**Is CVE-2025-30208 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-30208 being exploited in the wild.

**How severe is CVE-2025-30208?** Low severity, with a CVSS score of 3.1, published 25 March 2025.

**Which products and versions are affected?** Vite before 4.5.10; 5.0.0 through 5.4.14; 6.0.0 through 6.0.11; 6.1.0 through 6.1.1; 6.2.0 through 6.2.2.

**Is there a fix for CVE-2025-30208?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-30208 attacked?** It is attacked over the network.

**Am I affected by CVE-2025-30208?** Check whether you run Vite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an access control bypass (CWE-284) in Vite's server.fs.deny file access restrictions. The @fs virtual module is designed to restrict which files developers can serve, but the implementation fails to account for trailing query parameter separators (?) in its URL validation regex. By appending ?raw?? or ?import&raw?? to file paths in the @fs module, attackers can bypass the restriction check and retrieve file contents. The flaw requires the dev server to be explicitly exposed to the network (via --host or server.host config), and user interaction (crafting a request), but no authentication. Multiple versions are affected: all versions prior to 4.5.10, and versions 5.0.0–5.4.14, 6.0.0–6.0.11, 6.1.0–6.1.1, and 6.2.0–6.2.2. Patches are available.

## Affected products

- Vite Vite before 4.5.10; 5.0.0 through 5.4.14; 6.0.0 through 6.0.11; 6.1.0 through 6.1.1; 6.2.0 through 6.2.2

## Identifiers

- CVE-2025-30208
- GHSA-x574-m823-4x7w

## Timeline

- 2025-03-24: disclosed: Published on NVD
- 2025-03-25: advisory: Advisory published by GitHub (GHSA-x574-m823-4x7w)

## References

- [https://github.com/vitejs/vite/security/advisories/GHSA-x574-m823-4x7w](https://github.com/vitejs/vite/security/advisories/GHSA-x574-m823-4x7w)

## Related threats

- [Vite development server file access bypass via query parameters](https://junglewise.ai/threats/cve-2026-118662-vite-is-a-frontend-tooling-framework-for-javascript-from-6-4-4)
- [Vite information disclosure via WebAssembly query parameter](https://junglewise.ai/threats/cve-2026-112947-vite-is-a-frontend-tooling-framework-for-javascript-from-8-2-0)
- [Vite path traversal in transformIndexHtml](https://junglewise.ai/threats/cve-2026-112945-vite-is-a-frontend-tooling-framework-for-javascript-prior-to-6-4)
- [Vitejs launch-editor NTLM hash disclosure via UNC path handling](https://junglewise.ai/threats/cve-2026-53632-vitejs-launch-editor-ntlm-hash-disclosure-via-unc-path-handling)
- [Vite path traversal and sensitive file disclosure on Windows via NTFS ADS](https://junglewise.ai/threats/cve-2026-53571-vite-path-traversal-and-sensitive-file-disclosure-on-windows-via)