Vite - Path Traversal (CVE-2026-39365)
Description
Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow list and retrieve .map files located outside the project root, provided they can be parsed as valid source map JSON. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.
psychologyCrowdSec Analysis
CVE-2026-39365 is a path traversal vulnerability in Vite and Vite Plus, where the dev server's handling of .map file requests allows attackers to bypass directory restrictions and access source map files outside the project root. By exploiting this flaw, remote attackers could retrieve sensitive .map files, potentially exposing internal code structure or debugging information. This issue affects versions 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, and has been addressed in subsequent releases.
CrowdSec has been tracking this vulnerability and its exploits since 22nd of May 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2026-39365 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit this vulnerability by sending requests to URLs containing /node_modules/.vite/deps/../ followed by a target file and a .map extension, enabling path traversal to access sourcemap files outside the project root. This can leak sensitive source code or configuration data from Vite dev servers exposed to the network.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2026-04-07 |
| Rule Released | 2026-05-22 |
| CrowdSec First Seen | 2026-08-28 |