The Vite dev server's `server.fs.deny` configuration option uses picomatch with the `matchBase: true` setting, which only matches the basename of files rather than their full path. This behavior caused directory patterns (e.g., `/foo/**/*`) to not effectively deny access to files within those directories. Consequently, if an application sets a custom `server.fs.deny` including directory patterns and exposes the dev server to the network (via `--host` or `server.host`), unauthorized file access could occur. The issue also relates to the lack of the `{ dot: true }` option, which means dotfiles are not denied unless explicitly specified. The vulnerability is addressed in Vite versions 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10, and 2.9.18.

Only applications that configure a custom `server.fs.deny` with directory patterns and expose the Vite development server to the network are affected. In such cases, unauthorized access to files within denied directories (including dotfiles if not explicitly denied) is possible, potentially exposing sensitive files such as `.git/config`. The CVSS score is 5.9 (medium severity), indicating a moderate impact with network attack vector, high attack complexity, no privileges required, and no user interaction needed. Confidentiality is impacted, but integrity and availability are not.

A fix is available and users should upgrade to Vite versions 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10, or 2.9.18. Applications using custom `server.fs.deny` patterns with directories and exposing the dev server to the network should apply these updates promptly. No additional mitigation is required if the dev server is not exposed externally or if directory patterns are not used in `server.fs.deny`.