cc3305/cve-2025-30208CVE-2025-30208 exploit script
Using a special raw import query string on a vite dev server, a attacker can read arbitrary files
Vite dev servers before 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 can bypass the server.fs.deny file access checks for @fs requests. Appending ?raw?? or ?import&raw?? to an @fs URL returns the contents of files that should normally be blocked by the dev server allow list.
Only applications that explicitly expose the Vite dev server to the network are affected. "Normal" static production builds are not affected by this vulnerability.
