CVE-2026-39364 Details

A vulnerability exists in Vite versions 7.1.0 prior to 7.3.2 and 8.0.5, allowing files meant to be blocked by the server.fs.deny option, such as .env and *.crt files, to be accessed through the Vite development server. This issue arises when the server is exposed to the network and the sensitive files are located in directories permitted by the server.fs.allow option. Exploitation involves appending specific query parameters to the request, which can bypass the denial and return the file contents with an HTTP 200 response.

Users can upgrade to Vite version 7.3.2 or 8.0.5, both of which address this vulnerability.