CVE-2025-30208

CVE-2025-30208 一个针对 Vite /@fs/ 路径遍历 漏洞（CVE-2025-30208）中 transformMiddleware 的 任意文件读取 的 PoC 利用脚本。详细分析可参考此 文章。 受影响版本为 以下版本之前 ： 6.2.3 6.1.2 6.0.12 5.4.15 4.5.10 概述 Vite 是一个流行的开源项目，源码来自 Github 及其 官方网站。它在开发模式下使用特殊前缀 @fs 来允许直接访问 绝对文件路径 ： root@kitploit: GET /@fs/ 但 为了防止滥用 ，Vite 通过如下配置 限制 可通过 @fs 访问的内容：...

The vulnerability of the transformMiddleware function in the @fs mechanism of the local development server for Vite allows a hacker to read arbitrary files.

The vulnerability of the transformMiddleware function in the @fs mechanism of the local development server for Vite applications is related to incorrect processing of special symbols in input data. Exploiting this vulnerability allows a malicious actor to read arbitrary files by sending a special...

Exploit for CVE-2025-30208

CVE-2025-30208 A PoC of the exploit script for the Arbitrar...

PT-2025-13476 · Vite · Vite

Name of the Vulnerable Software and Affected Versions: Vite affected versions not specified Description: The issue is related to the transformMiddleware function of the @fs mechanism in Vite's local development server, which incorrectly handles special characters in input data. This can be...