Medium

Vite's server.fs.deny bypassed with /. for files under project root

Disclosed: 30.04.2025
Updated: 11.10.2026 10:22

Summary

The contents of files in the project root that are denied by a file matching pattern can be returned to the browser.

Impact

Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. Only files that are under project root and are denied by a file matching pattern can be bypassed.

Examples of file matching patterns: .env, .env.*, *.{crt,pem}, **/.env
Examples of other patterns: **/.git/**, .git/**, .git/**/*

Details

server.fs.deny can contain patterns matching against files (by default it includes .env, .env.*, *.{crt,pem} as such patterns). These patterns were able to bypass for files under root by using a combination of slash and dot (/.).

PoC

bash

npm create vite@latest
cd vite-project/
cat "secret" > .env
npm install
npm run dev
curl --request-target /.env/. http://localhost:5173

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
npm package	vite	>= 6.3.0, < 6.3.4, >= 6.2.0, < 6.2.7, >= 6.0.0, < 6.1.6, >= 5.0.0, < 5.4.19, < 4.5.14	6.3.4, 6.2.7, 6.1.6, 5.4.19, 4.5.14

References

CVSS score -

CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness (CWE): CWE-22
Platform: npm
Package: vite
Disclosed: 30.04.2025
Updated: 11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-859w-5945-r5v3 - CC BY 4.0

Vulnerability history: vite

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (24) in the archive

Total entries: 24
First → latest: 08.2022 10.2026
Without a fix: 0
Exploited in attacks: 1

Severity breakdown

High 8
Medium 14
Low 2

Disclosures per year

2022: 1
2023: 2
2024: 4
2025: 9
2026: 8

20.10.2026

launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

High CVE-2026-112942 >= 8.3.0, < 8.3.3, >= 8.2.0, < 8.2.4, >= 8.0.0, < 8.1.6, >= 7.0.0, < 7.3.7, < 6.4.4 8.3.3, 8.2.4, 8.1.6, 7.3.7, 6.4.4
15.06.2026

vite: `server.fs.deny` bypass on Windows alternate paths

High · 7.5 CVE-2026-53571 >= 8.0.0, < 8.0.16, >= 7.0.0, < 7.3.5, < 6.4.3 8.0.16, 7.3.5, 6.4.3
03.06.2026

launch-editor vulnerable to command injection via the crafted request on Windows

High CVE-2024-52011 < 5.4.9 5.4.9
06.04.2026

Vite: `server.fs.deny` bypassed with queries

High CVE-2026-39364 >= 8.0.0, < 8.0.5, >= 7.1.0, < 7.3.2 8.0.5, 7.3.2
06.04.2026

Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket

High CVE-2026-39363 >= 8.0.0, < 8.0.5, >= 7.0.0, < 7.3.2, >= 6.0.0, < 6.4.2 8.0.5, 7.3.2, 6.4.2
30.04.2025

Vite's server.fs.deny bypassed with /. for files under project root this entry

Medium CVE-2025-46565 >= 6.3.0, < 6.3.4, >= 6.2.0, < 6.2.7, >= 6.0.0, < 6.1.6, >= 5.0.0, < 5.4.19, < 4.5.14 6.3.4, 6.2.7, 6.1.6, 5.4.19, 4.5.14
19.01.2024

Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem

High · 7.5 CVE-2024-23331 >= 2.7.0, < 2.9.17, >= 3.0.0, < 3.2.8, >= 4.0.0, < 4.5.2, >= 5.0.0, < 5.0.12 2.9.17, 3.2.8, 4.5.2, 5.0.12
06.06.2023

Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)

High · 7.5 CVE-2023-34092 < 2.9.16, >= 3.0.2, < 3.2.7, >= 4.0.0, < 4.0.5, >= 4.1.0, < 4.1.5, >= 4.2.0, < 4.2.3, >= 4.3.0, < 4.3.9 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, 4.3.9
19.08.2022

Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service

High · 8.6 CVE-2022-35204 < 2.9.13, >= 3.0.0-alpha.0, < 3.0.0-beta.4 2.9.13, 3.0.0-beta.4

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application