{"id":"GHSA-fx2h-pf6j-xcff","revision":"08b4d021d0f5412c89ccc0f7a2c5f67f","records":[{"revision":"08b4d021d0f5412c89ccc0f7a2c5f67f","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-fx2h-pf6j-xcff","aliases":["CVE-2026-53571"],"title":"vite: `server.fs.deny` bypass on Windows alternate paths","description":"### Summary\n\nThe contents of files that are specified by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny) can be returned to the browser on Windows.\n\n### Impact\n\nOnly apps that match the following conditions are affected:\n\n- explicitly exposes the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host))\n- the sensitive file exists in the allowed directories specified by [`server.fs.allow`](https://vite.dev/config/server-options#server-fs-allow)\n- either of:\n  - the sensitive file exists in an NTFS volume\n  - the dev server is running on Windows and the sensitive file exists in a volume that 8.3 short name generation is enabled (it is enabled by default on system volumes)\n\n### Details\n\nVite’s dev server denies direct access to sensitive files through `server.fs.deny`, including entries such as `.env`, `.env.*`, and `*.{crt,pem}`. However, on Windows, the deny logic does not correctly normalize NTFS ADS path forms before access checks are applied.\nBecause of this, requests such as `/.env::$DATA?raw` are treated as allowed paths, while Windows resolves them to the original file's default data stream.\n\nSimilar to that, Windows allows accessing a file using a different name with the 8.3 short name compatibility feature. Vite did not reject accessing files via them.\n\n### PoC\n```bash\n$ npm create vite@latest\n$ cd vite-project/\n$ npm install\n$ npm run dev\n```\nAccess via browser at `http://localhost:5173/.env::$DATA?raw`\n<img width=\"388\" height=\"129\" alt=\"deecc1315123883cfd0f9c26a002845a\" src=\"https://github.com/user-attachments/assets/895c6012-4e2e-4a35-babb-69bbf3ee7170\" />\n\nExample expected result:\n- `/.env::$DATA?raw` returns the contents of `.env`\n- `/tls.pem::$DATA?raw` returns the contents of `tls.pem`","state":0,"publishedAt":"2026-06-15T17:17:45+00:00","modifiedAt":"2026-09-10T03:50:49.380122+00:00","affected":[{"ecosystem":"npm","name":"vite","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"8.0.0"},{"kind":"fixed","version":"8.0.16"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"vite","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"7.0.0"},{"kind":"fixed","version":"7.3.5"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"vite","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"6.4.3"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"vite-plus","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.1.24"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/vitejs/vite/security/advisories/GHSA-fx2h-pf6j-xcff","https://nvd.nist.gov/vuln/detail/CVE-2026-53571","https://github.com/vitejs/vite"],"sourceUrl":"https://github.com/advisories/GHSA-fx2h-pf6j-xcff","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-fx2h-pf6j-xcff","identifiers":["GHSA-fx2h-pf6j-xcff","CVE-2026-53571"]},"retained":false,"historicalAffected":[]}],"coverage":[]}