CVE-2026-118662Published

Vite: `server.fs.deny` bypassed with queries

Exact source revision recorded 3 Nov 2026 01:57:22 UTC. It does not establish the source's current position. Latest evidence.

Recorded JSON

cve-program · CVE-2026-118662

Published

Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite development server can evaluate server.fs.deny before stripping loader query parameters such as ?raw, ?import&raw, or ?import&url&inline. When the development server is exposed to the network and a sensitive file is inside server.fs.allow but matched by server.fs.deny, an unauthenticated attacker can append one of these queries and retrieve the denied file. This issue is fixed in version 6.4.5.

Source published: 28 Oct 2026 20:33:36 UTC
Source modified: 2 Nov 2026 23:57:05 UTC
Observed here: 3 Nov 2026 01:57:22 UTC
Source terms: CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · 6.9 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N