This vulnerability (CVE-2026-39364) in Vite occurs due to incorrect behavior order in validating before canonicalizing file paths on the Vite development server. Specifically, files that should be blocked by the server.fs.deny configuration, such as environment variable files (.env) and certificate files (*.crt), can be accessed by appending query parameters like ?raw, ?import&raw, or ?import&url&inline to the request URL. This bypasses intended security restrictions, resulting in unauthorized disclosure of sensitive files. The flaw is present in Vite versions from 7.1.0 up to but not including 7.3.2, and from versions before 8.0.5. The vulnerability is tracked under CWE-180 (Incorrect Behavior Order), CWE-284 (Improper Access Control), and CWE-472 (External Control of Assumed-Immutable Web Parameter). Red Hat advisories confirm the issue and provide no direct mitigation other than upgrading to fixed versions. The vulnerability has a high CVSS score of 8.2, reflecting its network attack vector, low complexity, no privileges or user interaction required, and high confidentiality impact.

Successful exploitation allows remote attackers to bypass file access restrictions on the Vite development server and retrieve sensitive files that should be blocked, including environment configuration files and certificate files. This unauthorized disclosure of sensitive information could facilitate further compromise of the affected system or environment. The vulnerability does not impact integrity or availability but poses a high confidentiality risk.

The vulnerability is fixed in Vite versions 7.3.2 and 8.0.5. Users should upgrade to these or later versions to remediate the issue. According to the Red Hat advisory, no alternative mitigation is currently available that meets their criteria for ease of use, applicability, and stability. Therefore, upgrading to a fixed version is the recommended remediation.