Vulnerability threat dossier
Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. Adding `?raw??` or `?import&raw??` to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as `?` are removed in several places, but are not accounted for in query string regexes. The contents of arbitrary files can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected. Versions 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 fix the issue.
VTP analyst assessment
CVE-2025-30208 can return files outside Vite's serving allow list when crafted trailing query separators bypass path checks. This creates a confidentiality risk when an affected Vite server can be reached and requested files exist.
0 record references and 0 source references passed trusted post-response validation. The current deterministic record contains 0 independent evidence groups.
No supplied source reports exploitation of this CVE.
First-party honeypot request semantics are potentially consistent with this CVE. This is an unconfirmed candidate match, not proof of exploitation or successful execution.
If you use Vite versions before the listed fixes, upgrade to the applicable fixed release.
First-party deterministic correlation
Honeypot request semantics are strongly consistent with CVE-2025-30208. This identifies likely attack intent, not successful exploitation or execution.
Basis: deterministic technical candidate
First-party deterministic correlation
Honeypot request semantics are strongly consistent with CVE-2025-30208. This identifies likely attack intent, not successful exploitation or execution.
Basis: deterministic technical candidate
VTP deterministic assessment
EPSS is 0.75; this is predictive context, not exploitation evidence.
First-party honeypot request semantics are potentially consistent with this CVE. This is an unconfirmed candidate match, not proof of exploitation or successful execution.
Material change ledger
No material changes are recorded for this subject.
Claim provenance
0 primary sources · 0 dependent secondary reports · 2 reports with unresolved independence. Repetition remains visible without multiplying confirmation.
Event history
ProjectDiscovery Nuclei Templates Releases published evidence linked to CVE-2025-30208.
Original publications
A mass-scanning campaign targeting internet-exposed Vite development servers is attempting to steal cloud credentials and configurations from AWS and Azure deployments. [...]
New Templates Added: 121 | CVEs Added: 61 | First-time contributions: 15 🔥 Release Highlights 🔥 [ CVE-2026-21643 ] Fortinet FortiClientEMS 7.4.4 - SQL Injection ( @ritikchaddha ) [critical] 🔥 (kev) (vKEV) [ CVE-2026-35616 ] FortiClient EMS - Authentication Bypass ( @ritikchaddha ) [high] 🔥 (kev) (vKEV) [ CVE-2026-39987 ] Marimo <= 0.20.4 - Pre-Auth Terminal WebSocket RCE ( @ritikchaddha ) [critical] 🔥 (vKEV) [ CVE-2025-59528 ] Flowise - Remote Code Execution (@xtr0nix) [critical] 🔥 (vKEV) [ CVE-2026-3584 ] WordPress Kali Forms <= 2.4.9 - Remote Code Execution ( @pussycat0x ) [critical] 🔥 (vKEV) [ CVE-2026-4020 ] Gravity SMTP WordPress Plugin - Sensitive Information Exposure ( @theamanrawat ) [high] 🔥 (vKEV) [ CVE-2026-34197 ] Apache ActiveMQ - Remote Code Execution ( @dhiyaneshdk , @horizon3 ) [critical] 🔥 [ CVE-2026-34156 ] NocoBase - VM Sandbox Escape to Remote Code Execution ( @theamanrawat ) [critical] 🔥 [ CVE-2026-20079 ] Cisco Secure Firewall Management Center - Authentication Bypass ( @theamanrawat ) [critical] 🔥 [ CVE-2026-26980 ] Ghost CMS Content API - SQL Injection ( @domwhewell-sage ) [critical] 🔥 [ CVE-2026-4257 ] WordPress Contact Form by Supsystic - Server-Side Template Injection ( @theamanrawat ) [critical] 🔥 [ CVE-2026-2699 ] Progress ShareFile Storage Zones Controller - Authentication Bypass ( @dhiyaneshdk ) [critical] 🔥 [CVE-2026-33340] LoLLMs WEBUI - Server-Side Request Forgery ( @theamanrawat ) [critical] 🔥 [ CVE-2025-67303 ] ComfyUI-Manager < 3.38 - Configuration Overwrite ( @maciejklimek ) [critical] 🔥 [ CVE-2024-38819 ] Spring Framework Path Traversal in Functional Web Frameworks ( @dhiyaneshdk ) [high] 🔥 What's Changed Bug Fixes Moved CVE-2026-23829 template from incorrect http folder to the network folder (Issue #15633 , PR #15738 ). Fixed CVE-ID mismatches in template metadata (PR #15850 ). Fixed invalid CPE formats across multiple HTTP templates (PR #15751 ). Fixed tag formatting in CVE-2023-38875 , CVE-2025-11307 , CVE-2023-24322 , and CVE-2025-4210 templates (PRs #15897 , #15898 , #15899 , #15900 ). Updated CVE-2023-6825 template to correct detection logic (PR #15877 ). Corrected template author attribution from PentesterTN to 0xBassia (PR #15827 ). False Negatives Fixed false negatives in CVE-2024-8529 (LearnPress SQLi): body matchers were unreliable for blind SQLi responses and a randstr bypass was added to defeat DB query cache (Issue #15768 , PR #15844 ). False Positives Reduced extremely high false positives in credentials-disclosure template caused by over-permissive [\w-]+ value regex with no minimum length enforcement, flagging short UI strings like "ClientSecret":"Client" as credential leaks (Issue #15563 , PR #15845 ). Reduced false positives in the Apache ActiveMQ Artemis Console Default Login template; tightened matcher to require a valid JSON login response with expected artemis username (Issue #15762 , PR #15861 ). Resolved false positives in molgenis-default-login template triggered by JSESSIONID cookies on custom 404 pages (Issue #12603 ). Removed false positive subdomain takeover detection templates for Netlify, Shopify, Azure Azurewebsites, Cloudapp, and Trafficmanager - these services are no longer vulnerable due to enforced TXT verification, deprecation, or claimed namespace blocking (PR #15724 ). Fixed false positive webpack-config detection triggered by SPA catch-all routing (PR #15869 ). Improved CVE-2022-3254 matchers to reduce false positives on HTML error responses (PR #15840 ). Fixed false positives in CVE-2024-52762 (PR #15833 ). Fixed false positives in CVE-2025-49113 (PR #15777 ). Enhancements Refactored matchers in CVE-2024-42009 for improved detection accuracy (PR #15835 ). Added and normalized CWE metadata across HTTP templates (PR #15804 ). Added additional EOL version entries to end-of-life detection templates (PR #15891 ). Updated CVE-2025-30208 detection coverage (PR #15784 ). Templates Added [ CVE-2026-39987 ] Marimo <= 0.20.4 - Pre-Auth Terminal W
Technical vulnerability data
Raw observations
First-party honeypot request semantics are potentially consistent with this CVE. This is an unconfirmed candidate match, not proof of exploitation or successful execution.