CVE-2025-30208

What it actually does

A path traversal vulnerability in the Vite development server allows an unauthenticated, remote attacker to read the contents of arbitrary files on the server's filesystem. The vulnerability stems from insufficient validation of user-supplied paths in HTTP requests. By crafting a request with directory traversal sequences (e.g., '../'), an attacker can navigate outside of the intended web root directory and access any file that the user running the Vite process has permissions to read.

Why it matters to the business

Exploitation of this vulnerability can lead to the theft of highly sensitive information, including application source code, configuration files containing database credentials or API keys, and system-level files. This data leakage can result in intellectual property loss, compromise of other systems through stolen credentials, significant reputational damage, and potential regulatory fines. The 'Weaponized' exploit maturity and high EPSS score indicate that this vulnerability is actively and easily exploited, posing an immediate and severe risk to affected development environments.

How an attack unfolds

An attacker first identifies a Vite development server exposed to a network they can access. They then send a specially crafted HTTP GET request to the server. The URL in this request contains path traversal sequences (e.g., `..%2f`) designed to navigate up the directory tree from the web root. For instance, a request to `http://<vulnerable-host>/?file=..%2f..%2f..%2fetc%2fpasswd` would cause the server to read the `/etc/passwd` file from the filesystem. The server then returns the contents of this file in the HTTP response, delivering it directly to the attacker, who can then use the stolen information for further attacks.

How to fix it

To remediate this vulnerability, upgrade the `vitejs/vite` package to a version that includes the security fix from commit `86e7a6b8e40cd2fd545744b82b2bc805ced92847` or a later version. After updating your project's dependencies, be sure to delete your lock file (e.g., `package-lock.json`, `yarn.lock`) and reinstall to ensure the patched version is used. As a security best practice, never expose development servers like Vite to untrusted networks such as the public internet. Configure firewall rules to restrict access to the development server to only trusted IP addresses or run it on localhost.

How to confirm the fix worked

To validate the patch has been applied, inspect your project's lock file (`package-lock.json`, `yarn.lock`, etc.) to confirm that the resolved version of `vite` is a patched one. To test for the vulnerability on a non-production, permissioned system, you can use a tool like `curl` to attempt to access a known, non-sensitive file outside the web root. For example: `curl http://<test-server>:<port>/..%2f..%2fetc%2fhosts`. A successful response containing the file's content indicates the system is vulnerable. A `403 Forbidden` or `404 Not Found` error suggests the patch is effective.

Typical attack path

1. Attacker discovers a publicly or internally exposed Vite development server.
2. Attacker crafts a malicious HTTP request with path traversal sequences to target a sensitive file.
3. The vulnerable server receives the request and, failing to sanitize the path, reads the requested file from the filesystem.
4. The server sends the file's contents back to the attacker in the HTTP response.
5. Attacker exfiltrates sensitive data, such as credentials or source code, and may use it to pivot to other systems.

How to detect it

To detect potential exploitation, review the access logs of Vite development servers. Look for HTTP GET requests containing URL-encoded path traversal sequences such as `..%2f`, `%2e%2e%2f`, `..\`, or `%2e%2e%5c`. Pay close attention to requests targeting common sensitive files like `.env`, `/etc/passwd`, `~/.ssh/id_rsa`, or configuration files. Correlate suspicious requests with any unusual outbound network activity from the server, which could indicate data exfiltration.

• GET /..%2f
• GET /%2e%2e%2f
• GET /..\
• GET /%2e%2e%5c
• /.env
• /etc/passwd
• /id_rsa

What your security team should do

• Immediately upgrade all projects using `vitejs/vite` to a patched version, as this vulnerability is actively exploited.
• Audit network configurations and firewall rules to ensure no development servers are exposed to the public internet.
• Scan web server access logs for indicators of compromise, such as path traversal sequences, to identify past exploitation attempts.
• Educate development teams on the risks of exposing development tools and the importance of secure coding practices.