type: cve · created: 2026-09-16 · updated: 2026-09-16 · tags: [cve] · confidence: medium · severity: medium · affected_sectors: [global] · au_impact: false
A file-disclosure flaw in the Vite dev server, part of the same family as CVE-2026-39364: Vite's @fs restriction on files outside the serving allow list can be bypassed by appending crafted query parameters to a request. NVD scores CVE-2025-30208 at 5.3 (Medium).
| Attribute | Detail |
|---|---|
| CVE | CVE-2025-30208 |
| CVSS | 5.3 (CVSS 3.1) (Medium) |
| Vendor / product | Vite / Vite dev server (older branches) |
| Reported | 2026-09-16 |
It is included here because the F5 campaign against exposed Vite dev servers worked across the whole family rather than through a single flaw — attackers chain whichever of these bypasses is unpatched on the host they find. That makes the patch-and-exposure pair the control rather than any individual CVE: upgrade Vite on every project, and stop exposing the dev server to anything but the loopback interface.