FS-attack

Implementation of the paper "Rethinking Latency Denial-of-Service: Attack the LLM Serving Framework, Not the Model"...

CVE-2025-30208

CVE-2025-30208 A PoC of the exploit script for the Arbitrary File Read vulnerability of Vite /@fs/ Path Traversal in transformMiddleware CVE-2025-30208. Detailed analysis can be refer to this post. Vulnerable in versions prior to : 6.2.3 6.1.2 6.0.12 5.4.15 4.5.10 Overview Vite is a popular...

ns2jb

Thank you Codex for dutifully packaging the exploits for distribution. No, I have not read the distributed package. Switch 2 FS demo Runs two small native functions inside FS, checks their results, and restores the original instructions. Switch 2 only; no npm install or compiler needed. You need...

ADFSDump

ADFSDump A C tool to dump all sorts of goodies from AD FS. Created by Doug Bienstock @doughsec while at Mandiant FireEye. This tool is designed to be run in conjunction with ADFSpoof. ADFSdump will output all of the information needed in order to generate security tokens using ADFSpoof. Detailed...

Vite-CVE-2025-30208-EXP

CVE-2025-30208 Detection Tool Vulnerability Analysis CVE-2025-30208 is an arbitrary file read vulnerability in the Vite development server. Attackers can read sensitive server files such as /etc/passwd or C:\windows\win.ini by constructing special paths e.g., @fs prefix. This tool supports...

CVE-2025-30208-Series

CVE-2025-30208 & CVE-2025-31125 & CVE-2025-31486 1. Vulnerability Overview CVE-2025-30208, CVE-2025-31125 and CVE-2025-31486 are arbitrary file reading vulnerabilities in the Vite development server. These vulnerabilities allow an attacker to bypass access controls through specific URL parameters...

CVE-2024-42471-PoC

CVE-2024-42471-PoC tar-fs file write/overwrite vulnerability...

CVE-2025-25612

CVE-2025-25612: FS S3150-8T2F Switch Stored Cross Site Scripting XSS CVE-2025-25612 FS Inc S3150-8T2F prior to version S3150-8T2F2.2.0D135103 is vulnerable to Cross Site Scripting XSS in the Time Range Configuration functionality of the administration interface. An attacker can inject malicious...

Path-Transversal-CVE-2025-31125-

Vite Exploit CVE-2025-31125 Description: Exploits path traversal in Vite Development Server's @fs endpoint CVE-2025-31125 to access sensitive files like /etc/passwd and /etc/hosts via crafted URLs. Created by Harsh Gupta. Usage: python viteexploit.py -u http://target.com python viteexploit.py -f...

CVE-2024-12905-PoC

CVE-2024-12905 tar-fs file write/overwrite vulnerability...

CVE-2025-30208-ViteVulnScanner

CVE-2025-30208-ViteVulnScanner Yo, this is a dope multi-threaded Python script by keklick1337 to hunt down domains vulnerable to CVE-2025-30208 in Vite. Basically, it checks if you can snag random files via the @fs endpoint with ?raw?? or ?import&raw?? — think /etc/passwd leaks and other juicy...

CLEANSTART-2026-AB53044 When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU

Security vulnerability affects the zookeeper-operator package. When parsing a Range header containing a large number of small ranges, FileServerFS, ServeContent, and ServeFileFS can consume an excessive amount of CPU...

CVE-2026-8023

CVE-2026-8023 — Zephyr HTTP static-fs path traversal PoC Pre-auth path traversal in Zephyr's HTTP server static-fs handler subsys/net/lib/http when wildcard resource matching CONFIGHTTPSERVERRESOURCEWILDCARD=y is used with HTTPRESOURCETYPESTATICFS. Affects both HTTP/1.1 and HTTP/2. GHSA:...

kernel: smb: client: reject a tree connect response whose byte count is too small

A flaw was found in the Linux kernel's Server Message Block SMB client. A remote malicious SMB server could send a specially crafted tree connect response with a byte count that is too small. This incorrect handling can lead to an integer underflow, causing the client to read beyond an allocated...

kernel: virtio-fs: avoid double-free on failed queue setup

A flaw was found in the Linux kernel's virtio-fs file system driver. When queue initialization fails—such as when a device advertises more request queues than supported—the driver fails to clear memory pointers after releasing them, resulting in a double-free condition during error cleanup. An...

CVE-2025-30208-PoC

Disclaimer: The vulnerabilities and reproduction steps described in this article are intended solely for cybersecurity research and educational purposes. No one shall use the information provided in this article for illegal purposes or unauthorized system testing. The author assumes no...

CVE-2025-30208

CVE-2025-30208 — Vite Arbitrary File Read · v5 CVE: CVE-2025-30208 GHSA: GHSA-x574-m823-4x7w Severity: CVSS 5.3 Medium network-accessible dev server ⚠ For authorized security engagements only. Unauthorized use against systems you do not own or have explicit written permission to test is illegal...

kernel: smb: client: reject a tree connect response whose byte count is too small

A flaw was found in the Linux kernel's Server Message Block SMB client. A remote malicious SMB server could send a specially crafted tree connect response with a byte count that is too small. This incorrect handling can lead to an integer underflow, causing the client to read beyond an allocated...

kernel: virtio-fs: avoid double-free on failed queue setup

A flaw was found in the Linux kernel's virtio-fs file system driver. When queue initialization fails—such as when a device advertises more request queues than supported—the driver fails to clear memory pointers after releasing them, resulting in a double-free condition during error cleanup. An...

CLEANSTART-2026-DA26397 When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU

CVE-2026-78667 affects multiple packages. When parsing a Range header containing a large number of small ranges, FileServerFS, ServeContent, and ServeFileFS can consume an excessive amount of CPU. See references for individual vulnerability details...