CVE-2025-30208

CVE-2025-30208 Usando uma string de consulta de importação raw especial em um servidor de desenvolvimento vite, um atacante pode ler arquivos arbitrários Resumo do CVE Servidores de desenvolvimento Vite anteriores a 6.2.3, 6.1.2, 6.0.12, 5.4.15 e 4.5.10 podem contornar as verificações de acesso a...

CVE-2025-30208

🔥 Scanner de Vulnerabilidade do Servidor de Desenvolvimento Vite CVE-2025-30208 🚀 Visão Geral Esta ferramenta verifica a vulnerabilidade CVE-2025-30208 no servidor de desenvolvimento Vite. Permite que pesquisadores de segurança detectem rapidamente instâncias vulneráveis usando múltiplos payloads...

CVE-2025-30208

中文 | English Scanner de Vulnerabilidades do Servidor de Desenvolvimento Vite Um scanner automatizado que cobre redes internas e externas Uma ferramenta automatizada para escanear vulnerabilidades do servidor de desenvolvimento Vite. Esta ferramenta utiliza a API FOFA para coletar alvos em potenci...

CVE-2025-30208-Series

CVE-2025-30208 & CVE-2025-31125 & CVE-2025-31486 1. Überblick über die Schwachstellen CVE-2025-30208, CVE-2025-31125 und CVE-2025-31486 sind Schwachstellen für beliebiges Dateilesen Arbitrary File Read im Vite-Entwicklungsserver. Diese Schwachstellen ermöglichen es Angreifern, durch spezifische...

CVE-2025-30208-EXP

CVE-2025-30208-EXP Vulnerabilità di lettura arbitraria di file nel server di sviluppo Vite CVE-2025-30208. La vulnerabilità ha una vasta copertura, è facile da sfruttare e senza restrizioni, i danni sono enormi! Query Fofa: root@kitploit: body="/@vite/client" Query Hunter: root@kitploit:...

CVE-2026-39363

CVE-2026-39363 — PoC لقراءة ملفات تعسفية من Vite Dev Server PoC قابل للتشغيل مباشرة ضد GHSA-p9ff-h696-f583. عبر استدعاء fetchModule من خلال HMR WebSocket غير مُصادَق، يتم تجاوز قيود server.fs.allow على طبقة HTTP لقراءة أي ملف من الجهاز الذي يعمل عليه خادم التطوير dev server. نطاق التأثير...

Vite Dev Server - Path Traversal in Optimized Deps .map Handling

Vite development server versions prior to 8.0.5, 7.3.2, and 6.4.2 are vulnerable to path traversal through the optimized dependencies sourcemap handler. The dev server's handling of .map requests for optimized dependencies resolves file paths via normalizePathpath.resolveroot, url.slice1 and call...

Vite Dev Server - Information Exposure

Vite is a frontend tooling framework for JavaScript. Before versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network using...

Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root

Summary A browser-based cross-origin request flaw in the Tina dev server allows an attacker-controlled website to cause arbitrary file creation inside the configured media upload directory on a developer machine running tinacms dev. No manual file upload is required. The attacker page builds the...

CVE-2026-53571

Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be returned to the browser on Windows. Vite’s dev server denies direct access to sensitive files through server.fs.deny, including entries such as...

PT-2026-49574

Name of the Vulnerable Software and Affected Versions Vite versions prior to 8.0.16 Vite versions prior to 7.3.5 Vite versions prior to 6.4.3 Description On Windows, the development server fails to correctly normalize NTFS Alternate Data Streams ADS path forms and 8.3 short name compatibility pat...

VulnCheck KEV: CVE-2026-39365

Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the...

Sensitive Information Disclosure

Vite is vulnerable to Sensitive Information Disclosure. The vulnerability is due to improper enforcement of file access restrictions in the dev server, which allows an attacker to bypass deny rules using crafted query parameters and access sensitive files...

Exploit for CVE-2026-39363

CVE-2026-39363 Vite Dev Server WebSocket Arbitrary File Read...

CVE-2026-39363

Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite:invoke and combine file://... with ?r...

CVE-2026-39365

Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the...

CVE-2026-39365

Vite Dev Server path traversal in optimized dependencies .map handling affects versions prior to 6.4.2, 7.3.2, and 8.0.5. The server resolves file paths via normalizePath(path.resolve(root, url.slice(1))) and calls readFile without restricting ../ segments, allowing retrieval of .map files outsid...

CVE-2026-39364 Vite has a `server.fs.deny` bypass with queries

Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny e.g., .env, .crt can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are...

CVE-2026-39364

Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny e.g., .env, .crt can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are...

CVE-2026-39364

CVE-2026-39364 affects the Vite dev server. Vulnerable versions include Vite 7.1.0 through 7.3.1 and 8.0.0 through 8.0.4; on those, files that should be blocked by server.fs.deny (e.g., .env, *.crt) could be retrieved via HTTP 200 when requesting with certain query params (?raw, ?import&raw, or ?...