# CVE-2026-39365: Vite - Path Traversal

> Live exploitation tracking for CVE-2026-39365 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-39365

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 6.3
- **Public exploit available:** Yes
- **Affected products:** Vitejs Vite, Vitejs Vite-Plus
- **Weaknesses:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
- **Tags:** javascript, web_application

## Description

Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow list and retrieve .map files located outside the project root, provided they can be parsed as valid source map JSON. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.

## CrowdSec analysis

[CVE-2026-39365](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-39365) is a path traversal vulnerability in Vite and Vite Plus, where the dev server's handling of .map file requests allows attackers to bypass directory restrictions and access source map files outside the project root. By exploiting this flaw, remote attackers could retrieve sensitive .map files, potentially exposing internal code structure or debugging information. This issue affects versions 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, and has been addressed in subsequent releases.

CrowdSec has been tracking this vulnerability and its exploits since 22nd of May 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-39365 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit this vulnerability by sending requests to URLs containing `/node_modules/.vite/deps/../` followed by a target file and a `.map` extension, enabling path traversal to access sourcemap files outside the project root. This can leak sensitive source code or configuration data from Vite dev servers exposed to the network.

## Timeline

- 2026-04-07: CVE Published. CVE-2026-39365 is published to NVD.
- 2026-05-22: Rule Released. CrowdSec releases a rule to detect CVE-2026-39365 exploitation attempts against the CrowdSec Network.
- 2026-08-28: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-39365 for the first time.

## References

- https://github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-39365.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-39365) follows observed exploitation activity for CVE-2026-39365. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.