CVE-2025-30208 PoC — Vite bypasses server.fs.deny when using `?raw??`

Source

https://github.com/ThumpBo/CVE-2025-30208-EXP

Associated Vulnerability

Title:Vite bypasses server.fs.deny when using `?raw??` (CVE-2025-30208)
Description:Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import&raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue.

Description

CVE-2025-30208-EXP

Readme

## CVE-2025-30208-EXP

Vite开发服务器任意文件读取漏洞（CVE-2025-30208），漏洞覆盖面大，利用简单且不受限制，漏洞危害巨大！

Fofa测绘语句:

```
body="/@vite/client"
```

鹰图Hunter测绘语句:

```
web.body="/@vite/client"
```

## Exp脚本使用方法

```
-u 进行检测
```

```
-p 自定义payload eg. /etc/passwd
```

```
-d 可以使用字典进行fuzz测试
```

### 不走代理使用本Exp

```
python3 Vite-CVE-2025-30208-EXP.py -f ip.txt
```

### 走HTTP代理使用本Exp

```
python3 Vite-CVE-2025-30208-EXP.py -f ip.txt --proxy http://127.0.0.1:8080
```

**注意！本项目非Poc，请在遵守免责声明的情况下使用！**

本项目将尝试对目标的 `/etc/passwd` ，进行检测是否存在任意文件读取，可以使用-p 指定想要读取的文件路径，-d 指定想要的fuzz字典

如果觉得不错欢迎给我点个Star😋

扫描结果将会匹配到的账号密码保存在 `output.txt` 中，其中 `IP.txt` 格式为 `http://[ip]/[domain]`，一行一个

## 免责声明

1. 如果您下载、安装、使用、修改本工具及相关代码，即表明您信任本工具
2. 在使用本工具时造成对您自己或他人任何形式的损失和伤害，我们不承担任何责任
3. 如您在使用本工具的过程中存在任何非法行为，您需自行承担相应后果，我们将不承担任何法律及连带责任
4. 请您务必审慎阅读、充分理解各条款内容，特别是免除或者限制责任的条款，并选择接受或不接受
5. 除非您已阅读并接受本协议所有条款，否则您无权下载、安装或使用本工具
6. 您的下载、安装、使用等行为即视为您已阅读并同意上述协议的约束

File Snapshot


 [4.0K]  /data/pocs/768bde542b7aca97d52ebaf791ee4d9fbb194f0b
├── [ 25K]  dict.txt
├── [ 26K]  LICENSE
├── [1.7K]  README.md
├── [  52]  requirements.txt
└── [7.0K]  Vite-CVE-2025-30208-EXP.py

0 directories, 5 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!