CVE-2026-39364highexplotación observadaCWE-180CWE-284CWE-472

CVE-2026-39364: fallo de gravedad alta en vitejs vite

Vite has a `server.fs.deny` bypass with queries

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear vite+ Monitorear vite-plus

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

58Vexday Risk Score

Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.

ssvc Actcvss 8.2epss 2.3%
de la publicación al arma
Publicada en NVD7 abr
VulnCheck+157d
Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended. This vulnerability is fixed in 7.3.2 and 8.0.5.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
vitejs · vitevitejs · vite-plus
CVEs relacionadas — vitejs vite

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-31125MEDIUMVite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` queryEPSS 74.9%KEVCVE-2025-30208MEDIUMVite bypasses server.fs.deny when using `?raw??`EPSS 74.8%CVE-2025-31486MEDIUMVite allows server.fs.deny to be bypassed with .svg or relative pathsEPSS 40.5%CVE-2026-39363HIGHVite Affected by Arbitrary File Read via Vite Dev Server WebSocketEPSS 3.4%CVE-2023-34092HIGHVite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)EPSS 3.2%CVE-2025-32395MEDIUMVite has an `server.fs.deny` bypass with an invalid `request-target`EPSS 1.8%