CVE-2025-30208-PoC

CVE-2025-30208 - Vite Arbitrary File Read PoC This is a Proof-of-Concept PoC script to exploit CVE-2025-30208, allowing arbitrary file reads on Vite development servers. Vulnerability Details Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2,...

CVE-2026-39363

CVE-2026-39363 — Vite Dev Server Arbitrary File Read PoC A drop-in PoC for GHSA-p9ff-h696-f583. It reads arbitrary files from the machine running the dev server by calling fetchModule over an unauthenticated HMR WebSocket, bypassing the HTTP-layer server.fs.allow restriction. Affected Versions...

CVE-2025-30208

🔥 Vite Dev Server Vulnerability Scanner CVE-2025-30208 🚀 Overview This tool scans for CVE-2025-30208, a vulnerability in the Vite Dev Server. It allows security researchers to quickly detect vulnerable instances using multiple payloads. ⚡ Features ✅ Single URL scanning -u URL ✅ Mass scanning from...

CVE-2025-30208-EXP

CVE-2025-30208-EXP Vite development server arbitrary file read vulnerability CVE-2025-30208, with wide coverage, simple exploitation, and no restrictions, posing a huge threat! Fofa search syntax: body="/@vite/client" Hunter search syntax: web.body="/@vite/client" Exp script usage -u to check -p...

CVE-2025-30208

CVE-2025-30208 — Vite Arbitrary File Read · v5 CVE: CVE-2025-30208 GHSA: GHSA-x574-m823-4x7w Severity: CVSS 5.3 Medium network-accessible dev server ⚠ For authorized security engagements only. Unauthorized use against systems you do not own or have explicit written permission to test is illegal...

Vite Dev Server - Path Traversal in Optimized Deps .map Handling

Vite development server versions prior to 8.0.5, 7.3.2, and 6.4.2 are vulnerable to path traversal through the optimized dependencies sourcemap handler. The dev server's handling of .map requests for optimized dependencies resolves file paths via normalizePathpath.resolveroot, url.slice1 and call...

Vite - Path Traversal

Vite versions prior to 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13 contain a file exposure vulnerability caused by improper handling of request URLs with '' in the dev server running on Node or Bun, letting attackers access arbitrary files, exploit requires the server to be exposed to the network an...

Vite Dev Server - Information Exposure

Vite is a frontend tooling framework for JavaScript. Before versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network using...

Vite server.fs.deny Bypass - Local File Inclusion

Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest- script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than...

CVE-2025-11953-PoC

Description The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and r...

CVE-2025-30208-31125-31486-32395

Vite Vulnerability Exploitation Guide CVE-2025-30208/31125/31486/32395 This document summarizes exploitation methods for four arbitrary file read vulnerabilities in the Vite development server, including examples for Linux and Windows systems. Note: For use only in authorized security testing...

CVE-2026-119201

The Nuxt web development framework (versions 4.6.0 through 4.6.3) is vulnerable to an information disclosure flaw where the dev server exposes a generated appSecret file (typically located at .nuxt/app-secret). This occurs because the file is stored within a directory permitted by the Vite server...

CVE-2025-30208

🔥 CVE-2025-30208 Vite Arbitrary File Read Vulnerability Scanner Advanced vulnerability scanner for CVE-2025-30208 with enterprise-grade features Professional penetration testing tool for Vite Arbitrary File Read vulnerability detection 🚀 Quick Start • 📋 Features • 🔧 Usage • 📊 Examples • 🛡️ Securit...

CVE-2026-119198

The Nuxt web development framework (versions 4.6.0 through 4.6.3 ) is vulnerable to an arbitrary file read via the development server. An attacker with TCP access to an exposed development server can send a nuxt:dev:client-error event over the HMR socket containing an absolute file path. The serv...

Vite: `server.fs.deny` bypassed with queries

Summary The contents of files that are specified by server.fs.deny can be returned to the browser. This is the same as https://github.com/vitejs/vite/security/advisories/GHSA-v2wj-q39q-566r. Impact Only apps that match the following conditions are affected: - explicitly exposes the Vite dev serve...

GHSA-8G5G-MXQH-GRGJ Vite: `server.fs.deny` bypassed with queries

Summary The contents of files that are specified by server.fs.deny can be returned to the browser. This is the same as https://github.com/vitejs/vite/security/advisories/GHSA-v2wj-q39q-566r. Impact Only apps that match the following conditions are affected: - explicitly exposes the Vite dev serve...

CVE-2025-30208

中文 | English Vite Dev Server Vulnerability Scanner 一个内外网通吃的自动化扫描器 An automated tool for scanning Vite development server vulnerabilities. This tool utilizes the FOFA API to collect potential targets and automatically detects specific vulnerabilities. Features Auto Automatic target asset collectio...

CVE-2026-39363

CVE-2026-39363 — Vite Dev Server WebSocket Arbitrary File Read Batch Detection Disclaimer: This tool is intended for authorized security testing and educational research only. Users must comply with local laws and regulations; unauthorized scanning or attacking others' systems is illegal. The...

CVE-2025-30208-Series

CVE-2025-30208 & CVE-2025-31125 & CVE-2025-31486 1. Vulnerability Overview CVE-2025-30208, CVE-2025-31125 and CVE-2025-31486 are arbitrary file reading vulnerabilities in the Vite development server. These vulnerabilities allow an attacker to bypass access controls through specific URL parameters...

CVE-2025-30208-template

CVE-2025-30208-template CVE-2025-30208 vite file read nuclei template Query HUNTER : http://product.name="Vite" FOFA : body="/@vite/client" SHODAN ：http.html:"/@vite/client" Run Nuclei Template nuclei -l target.txt -t CVE-2025-30208.yaml...