{"id":"CVE-2026-39364","state":"PUBLISHED","title":"Vite has a `server.fs.deny` bypass with queries","description":"Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended. This vulnerability is fixed in 7.3.2 and 8.0.5.","publishedAt":"2026-04-07T19:12:47.577Z","updatedAt":"2026-08-17T12:05:13.339Z","severity":{"score":8.2,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["vitejs vite","vitejs vite-plus"],"affected":[{"vendor":"vitejs","product":"vite","versions":[{"version":">= 8.0.0, < 8.0.5","status":"affected"},{"version":">= 7.1.0, < 7.3.2","status":"affected"}]},{"vendor":"vitejs","product":"vite-plus","versions":[{"version":"< 0.1.16","status":"affected"}]}],"references":["https://github.com/vitejs/vite/security/advisories/GHSA-v2wj-q39q-566r","https://access.redhat.com/security/cve/CVE-2026-39364","https://bugzilla.redhat.com/show_bug.cgi?id=2456181","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39364.json","https://access.redhat.com/errata/RHSA-2026:24866"],"weaknesses":["CWE-180","CWE-284","CWE-472"],"ingestedAt":"2026-10-29T20:11:50.837Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/39xxx/CVE-2026-39364.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-39364","state":"PUBLISHED","datePublished":"2026-04-07T19:12:47.577Z","dateUpdated":"2026-08-17T12:05:13.339Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2026-04-06T21:29:17.349Z"},"containers":{"cna":{"title":"Vite has a `server.fs.deny` bypass with queries","descriptions":[{"lang":"en","value":"Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended. This vulnerability is fixed in 7.3.2 and 8.0.5."}],"affected":[{"vendor":"vitejs","product":"vite","versions":[{"version":">= 8.0.0, < 8.0.5","status":"affected"},{"version":">= 7.1.0, < 7.3.2","status":"affected"}]},{"vendor":"vitejs","product":"vite-plus","versions":[{"version":"< 0.1.16","status":"affected"}]}],"references":[{"url":"https://github.com/vitejs/vite/security/advisories/GHSA-v2wj-q39q-566r","name":"https://github.com/vitejs/vite/security/advisories/GHSA-v2wj-q39q-566r","tags":["x_refsource_CONFIRM"]}],"metrics":[{"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-180","lang":"en","description":"CWE-180: Incorrect Behavior Order: Validate Before Canonicalize","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-284","lang":"en","description":"CWE-284: Improper Access Control","type":"CWE"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2026-04-07T19:12:47.577Z"},"source":{"advisory":"GHSA-v2wj-q39q-566r","discovery":"UNKNOWN"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-04-07T20:01:48.579074Z","id":"CVE-2026-39364","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-04-07T20:01:56.564Z"}},{"title":"vite: Vite: Information disclosure via query parameter manipulation on the development server","descriptions":[{"lang":"en","value":"A flaw was found in Vite, a frontend tooling framework for JavaScript. On the Vite development server, a remote attacker could exploit this vulnerability by appending specific query parameters, such as ?raw, to requests. This allows the attacker to bypass security restrictions and retrieve sensitive files, including environment variables (.env) and certificate files (*.crt), which should otherwise be blocked. This information disclosure could lead to further compromise of the system."}],"affected":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6","packageName":"ansible-automation-platform-tech-preview/mcp-server-rhel9","defaultStatus":"affected","versions":[{"version":"1779783248","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el9"]},{"vendor":"Red Hat","product":"Red Hat Advanced Cluster Security 4","packageName":"rhacs-eng/release-main","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:advanced_cluster_security:4"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","packageName":"automation-controller","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","packageName":"automation-eda-controller","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","packageName":"automation-gateway","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","packageName":"automation-platform-ui","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","packageName":"redhat-user-workloads/gateway-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]},{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"vite","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Build of Podman Desktop","packageName":"podman-desktop-macos-1-0","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:podman_desktop:1"]},{"vendor":"Red Hat","product":"Red Hat Build of Podman Desktop","packageName":"podman-desktop-windows-1-0","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:podman_desktop:1"]},{"vendor":"Red Hat","product":"Red Hat Build of Podman Desktop - Tech Preview","packageName":"redhat-user-workloads/bootc-ext","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:podman_desktop:0"]},{"vendor":"Red Hat","product":"Red Hat Build of Podman Desktop - Tech Preview","packageName":"redhat-user-workloads/openshift-local-ext","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:podman_desktop:0"]},{"vendor":"Red Hat","product":"Red Hat Build of Podman Desktop - Tech Preview","packageName":"redhat-user-workloads/rhel-ext","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:podman_desktop:0"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"vite","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","packageName":"vite","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jbosseapxp"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"redhat-user-workloads/art-images","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-39364","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456181","name":"RHBZ#2456181","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39364.json","tags":["x_sadp-csaf-vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24866","tags":["vendor-advisory","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-472","description":"External Control of Assumed-Immutable Web Parameter","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat-SADP","orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","dateUpdated":"2026-08-17T12:05:13.339Z"},"datePublic":"2026-04-07T19:12:47.577Z","solutions":[{"lang":"en","value":"RHSA-2026:24866: Red Hat Ansible Automation Platform 2.6"}],"timeline":[{"lang":"en","time":"2026-04-07T20:02:18.458Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-04-07T19:12:47.577Z","value":"Made public."}],"workarounds":[{"lang":"en","value":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}],"x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"}}]}}}