CVE-2026-39365 is a path traversal vulnerability (CWE-22) in the vitejs vite frontend tooling framework affecting versions 6.0.0 to before 6.4.2, 7.0.0 to before 7.3.2, and 8.0.0 to before 8.0.5. The issue arises because the dev server resolves file paths and reads .map files for optimized dependencies without properly restricting '../' segments in the URL, allowing attackers to bypass the configured server.fs.strict allow list. This enables unauthorized access to .map files located outside the intended project root directory, provided these files can be parsed as valid source map JSON. The vulnerability is addressed in vite versions 6.4.2, 7.3.2, and 8.0.5.

An attacker can exploit this vulnerability to read .map files outside the project root directory by bypassing the server.fs.strict allow list. This could lead to unauthorized disclosure of source map files, which may contain sensitive information about the source code structure. The CVSS 4.0 base score is 6.3, indicating a medium severity impact with network attack vector, low complexity, no privileges required, no user interaction, and low impact on confidentiality.

This vulnerability is fixed in vite versions 6.4.2, 7.3.2, and 8.0.5. Users should upgrade to one of these versions or later to remediate the issue. Patch status is confirmed by the version fixes listed in the vulnerability description. No additional vendor advisory was provided. No mitigation other than upgrading is indicated.