Vite versions from 2.5.1 up to but not including 5.4.6 contain a vulnerability where the server's file system access restrictions can be bypassed using the '?import&raw' query parameters. This allows an attacker to retrieve the contents of arbitrary files outside the intended serving allow list. The vulnerability has a medium severity with a CVSS score of 5.3.