CVE-2025-30208

中文 | English Vite Dev Server 脆弱性スキャナー 内部・外部ネットワーク両対応の自動スキャナー Vite 開発サーバーの脆弱性を自動でスキャンするツールです。FOFA API を利用して潜在的なターゲットを収集し、特定の脆弱性を自動検出します。 機能 自動モード FOFA 経由で自動的にターゲット資産を収集 マルチスレッドによる同時スキャン 自動 CSV レポート生成 手動モード CIDR 経由で手動によりターゲット資産を収集 マルチスレッドによる同時スキャン TXT からのターゲット読み込み TXT からのペイロード読み込み 自動 CSV レポート生成...

CVE-2025-30208-Series

CVE-2025-30208 & CVE-2025-31125 & CVE-2025-31486 1. 漏洞概述 CVE-2025-30208, CVE-2025-31125和CVE-2025-31486是Vite 开发服务器中的一个任意文件读取漏洞。该漏洞允许攻击者通过特定的 URL 参数绕过访问控制，通过fs模块读取服务器上的敏感文件。上述三个漏洞可以算作是一个系列的漏洞，因为造成漏洞的原因非常相似。 CVE-2025-30208影响版本如下所示 root@kitploit: =6.2.0, =6.1.0, =6.0.0, =5.0.0, =6.2.0, =6.1.0, =6.0.0...

Vite Dev Server - Path Traversal in Optimized Deps .map Handling

Vite development server versions prior to 8.0.5, 7.3.2, and 6.4.2 are vulnerable to path traversal through the optimized dependencies sourcemap handler. The dev server's handling of .map requests for optimized dependencies resolves file paths via normalizePathpath.resolveroot, url.slice1 and call...

Vite Dev Server - Information Exposure

Vite is a frontend tooling framework for JavaScript. Before versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network using...

CVE-2025-30208-EXP

CVE-2025-30208-EXP Vite開発サーバーの任意ファイル読み取り脆弱性（CVE-2025-30208）。影響範囲が広く、利用が簡単で制限がなく、脆弱性の影響は甚大です。 Fofa 検索構文: root@kitploit: body="/@vite/client" 鷹図Hunter 検索構文: root@kitploit: web.body="/@vite/client" Expスクリプトの使用方法 root@kitploit: -u で検査を実行 root@kitploit: -p カスタムペイロード例: /etc/passwd root@kitploit: -d...

CVE-2025-30208

CVE-2025-30208 特殊な raw import クエリ文字列を使用することで、Vite 開発サーバー上で攻撃者が任意のファイルを読み取ることができます。 Summary of the CVE Vite 開発サーバーのバージョン 6.2.3 未満、6.1.2 未満、6.0.12 未満、5.4.15 未満、4.5.10 未満では、@fs リクエストに対する server.fs.deny ファイルアクセスチェックがバイパスされる可能性があります。@fs URL に ?raw?? または ?import&raw??...

CVE-2026-39363

CVE-2026-39363 — Vite Dev Server WebSocket 任意文件读取批量检测 免责声明： 本工具仅用于授权的安全测试和教育研究。使用者应遵守当地法律法规，未经授权扫描或攻击他人系统属于违法行为。作者不对任何滥用行为承担责任。 漏洞描述 Vite 开发服务器（6.0.0 6.4.1, 7.0.0 7.3.1, 8.0.0 8.0.4）的 HMR WebSocket 未校验 Origin 头，攻击者可通过 vite:invoke 事件调用 fetchModule，使用 file:// 协议配合 ?raw 参数绕过 server.fs.allow...

CVE-2026-39363

CVE-2026-39363 — Vite Dev Server 任意文件读取 PoC 针对 GHSA-p9ff-h696-f583 的可直接运行 PoC。通过未鉴权的 HMR WebSocket 调用 fetchModule，绕过 HTTP 层的 server.fs.allow 限制，读取 dev server 所在机器上的任意文件。 影响范围 版本线| 受影响| 已修复 ---|---|--- Vite 6| =6.0.0, =7.0.0, =8.0.0, → 403）。 2. 但 HMR WebSocket 的握手只校验： Sec-WebSocket-Protocol:...

EUVD-2026-69705

Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock...

CVE-2025-30208

🔥 Escáner de Vulnerabilidad del Servidor de Desarrollo Vite CVE-2025-30208 🚀 Descripción general Esta herramienta escanea en busca de CVE-2025-30208, una vulnerabilidad en el Servidor de Desarrollo de Vite. Permite a los investigadores de seguridad detectar rápidamente instancias vulnerables...

Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root

Summary A browser-based cross-origin request flaw in the Tina dev server allows an attacker-controlled website to cause arbitrary file creation inside the configured media upload directory on a developer machine running tinacms dev. No manual file upload is required. The attacker page builds the...

CVE-2026-53571

Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be returned to the browser on Windows. Vite’s dev server denies direct access to sensitive files through server.fs.deny, including entries such as...

PT-2026-49574

Name of the Vulnerable Software and Affected Versions Vite versions prior to 8.0.16 Vite versions prior to 7.3.5 Vite versions prior to 6.4.3 Description On Windows, the development server fails to correctly normalize NTFS Alternate Data Streams ADS path forms and 8.3 short name compatibility pat...

VulnCheck KEV: CVE-2026-39365

Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the...

Sensitive Information Disclosure

Vite is vulnerable to Sensitive Information Disclosure. The vulnerability is due to improper enforcement of file access restrictions in the dev server, which allows an attacker to bypass deny rules using crafted query parameters and access sensitive files...

Exploit for CVE-2026-39363

CVE-2026-39363 Vite Dev Server WebSocket Arbitrary File Read...

CVE-2026-39363

Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite:invoke and combine file://... with ?r...

CVE-2026-39365

Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the...

CVE-2026-39365

Vite Dev Server path traversal in optimized dependencies .map handling affects versions prior to 6.4.2, 7.3.2, and 8.0.5. The server resolves file paths via normalizePath(path.resolve(root, url.slice(1))) and calls readFile without restricting ../ segments, allowing retrieval of .map files outsid...

CVE-2026-39364

Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny e.g., .env, .crt can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are...