CVE-2026-39364
HighCVSS 7.5Exploitation Probability (EPSS)
High risk80th percentile - higher than 80% of all known CVEs
Summary
Vite versions 7.1.0 to before 7.3.2 and 8.0.5 allow bypassing server.fs.deny restrictions. Files like .env or *.crt can be retrieved with HTTP 200 by appending query parameters ?raw, ?import&raw, or ?import&url&inline.
Risk Assessment
An attacker can access sensitive configuration files (e.g., .env) and certificates, leading to credential and key leakage.
Recommendation
Update Vite to version 7.3.2 or 8.0.5, which fix this vulnerability.
Other vulnerabilities in Vite
See all- CVE-2025-31125MediumActively exploited
Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.
- CVE-2026-53571High
Vite is a frontend tooling framework for JavaScript that, prior to versions 8.0.16, 7.3.5, and 6.4.3, could return the contents of files specified by server.fs.deny to the browser on Windows. Issues with NTFS ADS path normalization allowed unauthorized access to sensitive files.
- CVE-2026-39365Medium
Vite, a frontend tooling framework for JavaScript, versions 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, has a vulnerability in handling .map requests for optimized dependencies. The dev server resolves file paths and calls readFile without restricting ../ segments in the URL, allowing bypass of the server.fs.strict allow list and retrieval of .map files outside the project root if they can be parsed as valid source map JSON.
- CVE-2026-39363High
A vulnerability in Vite (a frontend tooling framework for JavaScript) from 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5 allows an attacker who can connect to the Vite dev server's WebSocket without an Origin header to invoke fetchModule via the vite:invoke event and read arbitrary files on the server as a JavaScript string. HTTP access controls are not applied to this WebSocket channel.
- CVE-2025-62522Medium
Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended with \ when the dev server was running on Windows. Only apps explicitly exposing the Vite dev server to the network and running the dev server on Windows were affected.
- CVE-2025-58752Medium
Vite before versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 serves any HTML files on the machine regardless of server.fs settings. Affects apps that expose the dev server to the network and use appType 'spa' or 'mpa'. The preview server is also vulnerable.
- CVE-2023-34092High
Vite, a frontend tooling, has a vulnerability that allows bypassing server options (`server.fs.deny`) using double forward-slash (//). This enables unauthenticated users to read files from the Vite application's root path, including default `fs.deny` settings.
Original NVD description (English source)
Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended. This vulnerability is fixed in 7.3.2 and 8.0.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS