PT-2025-13476 · Vite · Vite

Published 2025-03-24 · Updated 2025-04-03 · CVE-2025-30108

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Vite (affected versions not specified)

Description The issue is related to the transformMiddleware function of the @fs mechanism in Vite's local development server, which incorrectly handles special characters in input data. This can be exploited by a remote attacker to read arbitrary files by sending a specially crafted GET request.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

RCE

Weakness Enumeration

CWE-22

CWE-20

Related Identifiers

BDU:2025-03698

BDU:2026-00170

CVE-2025-30108

Affected Products

Vite

References · 11

• 🔥 https://github.com/4xura/CVE-2025-30108 · Exploit
• https://bdu.fstec.ru/vul/2026-00170 · Security Note
• https://bdu.fstec.ru/vul/2025-03698 · Security Note
• https://github.com/vitejs/vite/commit/f234b5744d8b74c95535a7b82cc88ed2144263c1 · Note
• https://github.com/vitejs/vite/commit/80381c38d6f068b12e6e928cd3c616bd1d64803c · Note
• https://github.com/vitejs/vite/security/advisories/GHSA-x574-m823-4x7w · Note
• https://github.com/vitejs/vite/commit/807d7f06d33ab49c48a2a3501da3eea1906c0d41 · Note
• https://github.com/vitejs/vite/commit/92ca12dc79118bf66f2b32ff81ed09e0d0bd07ca · Note
• https://github.com/vitejs/vite/commit/315695e9d97cc6cfa7e6d9e0229fb50cdae3d9f4 · Note
• https://twitter.com/fletch_ai/status/1905530406142967972 · Twitter Post
• https://twitter.com/attritionorg/status/1907866042363433012 · Twitter Post