{"id":"CVE-2026-39364","published":"2026-04-07T19:12:47Z","modified":"2026-08-17T12:05:13Z","title":"Vite has a `server.fs.deny` bypass with queries","vendor":"vitejs","product":"vite","tier":"core","eol":null,"affectedVersions":[{"vendor":"vitejs","product":"vite","versions":[">= 8.0.0, < 8.0.5",">= 7.1.0, < 7.3.2"]},{"vendor":"vitejs","product":"vite-plus","versions":["< 0.1.16"]}],"description":{"text":"Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended. This vulnerability is fixed in 7.3.2 and 8.0.5.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":8.2,"severity":"HIGH","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.02259,"percentile":0.82948,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-09-11","exploitedFirstSeen":"2026-09-11","ransomware":false,"evidence":[{"url":"https://www.f5.com/labs/articles/cloud-takeover-mass-scanning-for-exposed-vite-endpoints-cve-2026-39364","date":"2026-09-11"},{"url":"https://previdian.com/CVE-2026-39364","date":"2026-09-15"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":21,"pulses":[{"name":"Exposed Vite Development Servers Targeted for AWS and Azure Credential Theft","url":"https://otx.alienvault.com/pulse/6aabdf602847b323f935580a","created":"2026-09-17"},{"name":"Vite CVE-2026-39364 Mass Scan: Cloud Credential & IaC Theft from Exposed Dev Servers","url":"https://otx.alienvault.com/pulse/6aaa31bc3e91de6c050ac182","created":"2026-09-16"},{"name":"Mass-Scanning Campaign Exploits Vite Flaw to Extract Cloud Credentials From Exposed Dev Servers","url":"https://otx.alienvault.com/pulse/6aa9406e744080ca6dddb815","created":"2026-09-15"},{"name":"Vite CVE-2026-39364 Mass Scanning for AWS/Azure Secrets","url":"https://otx.alienvault.com/pulse/6aa8e00b9ed2e3fb07d8e04e","created":"2026-09-15"},{"name":"Hackers target exposed Vite dev servers to steal AWS, Azure secrets","url":"https://otx.alienvault.com/pulse/6aa827098a5afc79562c13c8","created":"2026-09-14"},{"name":"Known_Cve | Apr 24, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/69ea3f5ba5d3a028c6ef7ecf","created":"2026-04-23"},{"name":"Known_Cve | Apr 23, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/69e8ec53d8e9285aa573199c","created":"2026-04-22"},{"name":"Known_Cve | Apr 22, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/69e79c01c3d8244296d32902","created":"2026-04-21"},{"name":"Known_Cve | Apr 21, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/69e64ae4502f00a0cc9986e5","created":"2026-04-20"},{"name":"Known_Cve | Apr 20, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/69e4f971582b6761602eb4a2","created":"2026-04-19"}],"provenance":"machine"},"cwes":[{"id":"CWE-180","name":"Incorrect Behavior Order: Validate Before Canonicalize"},{"id":"CWE-284","name":"Improper Access Control"},{"id":"CWE-472","name":"External Control of Assumed-Immutable Web Parameter"}],"references":[{"url":"https://github.com/vitejs/vite/security/advisories/GHSA-v2wj-q39q-566r","tags":["x_refsource_CONFIRM"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-39364","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456181","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39364.json","tags":["x_sadp-csaf-vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24866","tags":["vendor-advisory","x_refsource_REDHAT"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"npm","package":"vite","vulnerableRanges":[">=8.0.0, <8.0.5",">=7.1.0, <7.3.2"],"patched":["8.0.5","7.3.2"],"from":["GHSA-v2wj-q39q-566r"],"provenance":"source"}],"advisories":[{"id":"GHSA-v2wj-q39q-566r","url":"https://github.com/advisories/GHSA-v2wj-q39q-566r","severity":"HIGH","ecosystem":"npm","package":"vite","vulnerableRanges":[">=8.0.0, <8.0.5"],"patched":["8.0.5"],"provenance":"source","from":"GHSA"},{"id":"GHSA-v2wj-q39q-566r","url":"https://github.com/advisories/GHSA-v2wj-q39q-566r","severity":"HIGH","ecosystem":"npm","package":"vite","vulnerableRanges":[">=7.1.0, <7.3.2"],"patched":["7.3.2"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2026-19873","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-19873","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2026-39364","name":"Vite Dev Server - Directory Traversal","severity":"high","path":"http/cves/2026/CVE-2026-39364.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-39364.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-04-07","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2026-39364","provenance":"source"},{"date":"2026-09-11","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.f5.com/labs/articles/cloud-takeover-mass-scanning-for-exposed-vite-endpoints-cve-2026-39364","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":75.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":10.0,"detail":"added 50 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":16.59,"detail":"percentile 0.8295"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"21 pulses"},{"name":"CVSS severity","points":5.74,"detail":"base score 8.2"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-vitejs-vite-cve-2022-35204","parents":[{"from":"CVE-2024-45811","to":"CVE-2026-39364","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["packages/vite/src/node/server/middlewares/transform.ts","playground/fs-serve/root/src/index.html"],"commits":["https://github.com/vitejs/vite/commit/6820bb3b9a54334f3268fc5ee1e967d2e1c0db34","https://github.com/vitejs/vite/commit/4573a6fd6f1b097fb7296a3e135e0646b996b249","https://github.com/vitejs/vite/commit/a9a3df299378d9cbc5f069e3536a369f8188c8ff"],"basis":"shared function","functions":["transformMiddleware"]}]},{"from":"CVE-2025-30208","to":"CVE-2026-39364","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["packages/vite/src/node/server/middlewares/transform.ts","playground/fs-serve/root/src/index.html"],"commits":["https://github.com/vitejs/vite/commit/315695e9d97cc6cfa7e6d9e0229fb50cdae3d9f4","https://github.com/vitejs/vite/commit/80381c38d6f068b12e6e928cd3c616bd1d64803c","https://github.com/vitejs/vite/commit/a9a3df299378d9cbc5f069e3536a369f8188c8ff"],"basis":"shared function","functions":["transformMiddleware"]}]},{"from":"CVE-2025-31125","to":"CVE-2026-39364","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["packages/vite/src/node/server/middlewares/transform.ts","playground/fs-serve/root/src/index.html"],"commits":["https://github.com/vitejs/vite/commit/59673137c45ac2bcfad1170d954347c1a17ab949","https://github.com/vitejs/vite/commit/a9a3df299378d9cbc5f069e3536a369f8188c8ff"],"basis":"shared function","functions":["transformMiddleware"]}]},{"from":"CVE-2025-31486","to":"CVE-2026-39364","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["packages/vite/src/node/server/middlewares/transform.ts","playground/fs-serve/root/src/index.html"],"commits":["https://github.com/vitejs/vite/commit/62d7e81ee189d65899bb65f3263ddbd85247b647","https://github.com/vitejs/vite/commit/a9a3df299378d9cbc5f069e3536a369f8188c8ff"],"basis":"shared function","functions":["transformMiddleware"]}]}],"children":[{"from":"CVE-2026-39364","to":"CVE-2026-39365","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["packages/vite/src/node/server/middlewares/transform.ts"],"commits":["https://github.com/vitejs/vite/commit/a9a3df299378d9cbc5f069e3536a369f8188c8ff","https://github.com/vitejs/vite/commit/79f002f2286c03c88c7b74c511c7f9fc6dc46694"],"basis":"shared function","functions":["transformMiddleware"]}]}],"packageHistory":[{"cve":"CVE-2025-58752","published":"2025-09-08","fixed":"7.1.5","kev":false},{"cve":"CVE-2025-62522","published":"2025-10-20","fixed":"7.1.11","kev":false,"link":{"from":"CVE-2025-62522","to":"CVE-2026-39364","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:vite","fromFixed":"7.1.11","toFixed":"7.3.2","daysApart":169}]}},{"cve":"CVE-2026-39363","published":"2026-04-07","fixed":"8.0.5","kev":false},{"cve":"CVE-2026-39364","published":"2026-04-07","fixed":"8.0.5","kev":false},{"cve":"CVE-2026-39365","published":"2026-04-07","fixed":"8.0.5","kev":false},{"cve":"CVE-2026-53571","published":"2026-06-22","fixed":"8.0.16","kev":false},{"cve":"CVE-2026-53632","published":"2026-06-22","fixed":"8.0.16","kev":false}],"package":"npm:vite"}}