Vite versions 7.1.0 to before 7.3.2 and 8.0.0 to before 8.0.5 contain a vulnerability (CVE-2026-39364) where the dev server improperly allows access to files that should be blocked by the server.fs.deny setting. This occurs because the server validates file access permissions after canonicalizing the file path, allowing crafted requests with query parameters (?raw, ?import&raw, or ?import&url&inline) to bypass restrictions and retrieve sensitive files with HTTP 200 responses. The issue is categorized under CWE-180 (Incorrect Behavior Order: Validate Before Canonicalize) and CWE-284 (Improper Access Control). The vulnerability has a CVSS 4.0 score of 8.2 (high severity). It is resolved in Vite versions 7.3.2 and 8.0.5.

An attacker can retrieve sensitive files that should be blocked by the server.fs.deny configuration on the Vite development server, potentially exposing environment variables (.env) or certificate files (*.crt). This unauthorized file access could lead to information disclosure impacting the confidentiality of the affected system. The vulnerability does not require privileges or user interaction but is limited to the development server context.

This vulnerability is fixed in Vite versions 7.3.2 and 8.0.5. Users should upgrade to these or later versions to remediate the issue. Since the vulnerability affects specific versions and is resolved in official releases, applying the official patch by upgrading is the recommended mitigation. No vendor advisory content contradicts this guidance. Patch status is confirmed by the version fix information in the description.