A directory traversal bypass vulnerability in Vite's dev server allows reading files under the project root that should be denied by server.fs.deny patterns. This affects Vite versions from 2.5.1 up to but not including 6.3.4. The issue occurs when the deny patterns are circumvented using a '/.' sequence in the request path. Only applications exposing the Vite dev server to the network are impacted. A fix is available in version 6.3.4.