Executive brief
Vite is a popular build tool and development server for modern JavaScript applications. On Windows systems, an attacker can bypass file access restrictions (server.fs.deny) by appending a backslash to URLs, allowing exposure of sensitive files like environment configuration and cryptographic keys. This only affects development servers explicitly exposed to the network.
Technical details
This is a path traversal bypass (CWE-22) affecting Vite's file serving restrictions on Windows. The vulnerability stems from fs.readFile('/foo.png/') loading '/foo.png', which allows an attacker to bypass patterns in server.fs.deny by appending a backslash to the request URL (e.g., /.env\). The attack requires the dev server to be running on Windows and explicitly exposed to the network via --host or server.host configuration. An unauthenticated network attacker can read files that should be denied by default (including .env, .env.*, and certificate/key files). Patches are available in versions 5.4.21, 6.4.1, 7.0.8, and 7.1.11 or later.
Affected products
- Vite Vite >=2.9.18,<3.0.0; >=3.2.9,<4.0.0; >=4.5.3,<5.0.0; >=5.2.6,<=5.4.20; >=6.0.0,<=6.4.0; >=7.0.0,<=7.0.7; >=7.1.0,<=7.1.10
Timeline
- 2025-10-20: disclosed: Advisory published
- 2025-10-20: patched: Patches released in versions 5.4.21, 6.4.1, 7.0.8, 7.1.11