{"id":"CVE-2026-39365","published":"2026-04-07T19:13:50Z","modified":"2026-04-15T14:23:24Z","title":"Vite has a Path Traversal in Optimized Deps `.map` Handling","vendor":"vitejs","product":"vite","tier":"core","eol":null,"affectedVersions":[{"vendor":"vitejs","product":"vite","versions":[">= 8.0.0, < 8.0.5",">= 7.0.0, < 7.3.2",">= 6.0.0, < 6.4.2"]},{"vendor":"vitejs","product":"vite-plus","versions":["< 0.1.16"]}],"description":{"text":"Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow list and retrieve .map files located outside the project root, provided they can be parsed as valid source map JSON. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":6.3,"severity":"MEDIUM","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00914,"percentile":0.6008,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-05-22","exploitedFirstSeen":null,"ransomware":false,"evidence":[],"evidenceTotal":0,"provenance":"source"},"exploited":true,"otx":{"pulseCount":16,"pulses":[{"name":"Known_Cve | Apr 24, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/69ea3f5ba5d3a028c6ef7ecf","created":"2026-04-23"},{"name":"Known_Cve | Apr 23, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/69e8ec53d8e9285aa573199c","created":"2026-04-22"},{"name":"Known_Cve | Apr 22, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/69e79c01c3d8244296d32902","created":"2026-04-21"},{"name":"Known_Cve | Apr 21, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/69e64ae4502f00a0cc9986e5","created":"2026-04-20"},{"name":"Known_Cve | Apr 20, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/69e4f971582b6761602eb4a2","created":"2026-04-19"},{"name":"Known_Cve | Apr 19, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/69e3a7638300f0eb1346a035","created":"2026-04-18"},{"name":"Known_Cve | Apr 18, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/69e25442402a04b23b8aa1a2","created":"2026-04-17"},{"name":"Known_Cve | Apr 17, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/69e103976603776b725a4a5a","created":"2026-04-16"},{"name":"Known_Cve | Apr 15, 2026","url":"https://otx.alienvault.com/pulse/69de5f919b88b9566b77d9fa","created":"2026-04-14"},{"name":"Known_Cve | Apr 14, 2026","url":"https://otx.alienvault.com/pulse/69dd7235cc14d6e4d874a258","created":"2026-04-13"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9","tags":["x_refsource_CONFIRM"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"npm","package":"vite","vulnerableRanges":[">=8.0.0, <8.0.5",">=7.0.0, <7.3.2","<6.4.2"],"patched":["8.0.5","7.3.2","6.4.2"],"from":["GHSA-4w7w-66w2-5vf9"],"provenance":"source"}],"advisories":[{"id":"GHSA-4w7w-66w2-5vf9","url":"https://github.com/advisories/GHSA-4w7w-66w2-5vf9","severity":"MODERATE","ecosystem":"npm","package":"vite","vulnerableRanges":[">=8.0.0, <8.0.5"],"patched":["8.0.5"],"provenance":"source","from":"GHSA"},{"id":"GHSA-4w7w-66w2-5vf9","url":"https://github.com/advisories/GHSA-4w7w-66w2-5vf9","severity":"MODERATE","ecosystem":"npm","package":"vite","vulnerableRanges":[">=7.0.0, <7.3.2"],"patched":["7.3.2"],"provenance":"source","from":"GHSA"},{"id":"GHSA-4w7w-66w2-5vf9","url":"https://github.com/advisories/GHSA-4w7w-66w2-5vf9","severity":"MODERATE","ecosystem":"npm","package":"vite","vulnerableRanges":["<6.4.2"],"patched":["6.4.2"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2026-19875","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-19875","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2026-39365","name":"Vite Dev Server - Path Traversal in Optimized Deps .map Handling","severity":"medium","path":"http/cves/2026/CVE-2026-39365.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-39365.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-04-07","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2026-39365","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":64.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 162 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":12.02,"detail":"percentile 0.6008"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":2.79,"detail":"16 pulses"},{"name":"CVSS severity","points":4.41,"detail":"base score 6.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-vitejs-vite-cve-2022-35204","parents":[{"from":"CVE-2024-45811","to":"CVE-2026-39365","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["packages/vite/src/node/server/middlewares/transform.ts"],"commits":["https://github.com/vitejs/vite/commit/6820bb3b9a54334f3268fc5ee1e967d2e1c0db34","https://github.com/vitejs/vite/commit/4573a6fd6f1b097fb7296a3e135e0646b996b249","https://github.com/vitejs/vite/commit/79f002f2286c03c88c7b74c511c7f9fc6dc46694"],"basis":"shared function","functions":["transformMiddleware"]}]},{"from":"CVE-2025-30208","to":"CVE-2026-39365","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["packages/vite/src/node/server/middlewares/transform.ts"],"commits":["https://github.com/vitejs/vite/commit/315695e9d97cc6cfa7e6d9e0229fb50cdae3d9f4","https://github.com/vitejs/vite/commit/80381c38d6f068b12e6e928cd3c616bd1d64803c","https://github.com/vitejs/vite/commit/79f002f2286c03c88c7b74c511c7f9fc6dc46694"],"basis":"shared function","functions":["transformMiddleware"]}]},{"from":"CVE-2025-31125","to":"CVE-2026-39365","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["packages/vite/src/node/server/middlewares/transform.ts"],"commits":["https://github.com/vitejs/vite/commit/59673137c45ac2bcfad1170d954347c1a17ab949","https://github.com/vitejs/vite/commit/79f002f2286c03c88c7b74c511c7f9fc6dc46694"],"basis":"shared function","functions":["transformMiddleware"]}]},{"from":"CVE-2025-31486","to":"CVE-2026-39365","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["packages/vite/src/node/server/middlewares/transform.ts"],"commits":["https://github.com/vitejs/vite/commit/62d7e81ee189d65899bb65f3263ddbd85247b647","https://github.com/vitejs/vite/commit/79f002f2286c03c88c7b74c511c7f9fc6dc46694"],"basis":"shared function","functions":["transformMiddleware"]}]},{"from":"CVE-2026-39364","to":"CVE-2026-39365","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["packages/vite/src/node/server/middlewares/transform.ts"],"commits":["https://github.com/vitejs/vite/commit/a9a3df299378d9cbc5f069e3536a369f8188c8ff","https://github.com/vitejs/vite/commit/79f002f2286c03c88c7b74c511c7f9fc6dc46694"],"basis":"shared function","functions":["transformMiddleware"]}]}],"packageHistory":[{"cve":"CVE-2025-62522","published":"2025-10-20","fixed":"7.1.11","kev":false,"link":{"from":"CVE-2025-62522","to":"CVE-2026-39365","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:vite","fromFixed":"7.1.11","toFixed":"7.3.2","daysApart":169},{"kind":"version-step","provenance":"source","package":"npm:vite","fromFixed":"6.4.1","toFixed":"6.4.2","daysApart":169}]}},{"cve":"CVE-2026-39363","published":"2026-04-07","fixed":"8.0.5","kev":false},{"cve":"CVE-2026-39364","published":"2026-04-07","fixed":"8.0.5","kev":false},{"cve":"CVE-2026-39365","published":"2026-04-07","fixed":"8.0.5","kev":false},{"cve":"CVE-2026-53571","published":"2026-06-22","fixed":"8.0.16","kev":false},{"cve":"CVE-2026-53632","published":"2026-06-22","fixed":"8.0.16","kev":false},{"cve":"CVE-2026-112942","published":"2026-10-20","fixed":"8.3.3","kev":false}],"package":"npm:vite"}}