{"id":"CVE-2026-53571","aliases":["GHSA-fx2h-pf6j-xcff"],"title":"vite: `server.fs.deny` bypass on Windows alternate paths","summary":"vite: `server.fs.deny` bypass on Windows alternate paths","severity":"high","cwe":["CWE-22","CWE-200"],"vendor":"vite","product":"vite","ecosystem":"npm","affected":["vite >= 8.0.0, <= 8.0.15","vite >= 7.0.0, <= 7.3.4","vite <= 6.4.2","vite-plus <= 0.1.23"],"patched":["vite 8.0.16","vite 7.3.5","vite 6.4.3","vite-plus 0.1.24"],"published":"2026-06-15","updated":"2026-06-15","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-fx2h-pf6j-xcff","references":[{"url":"https://github.com/vitejs/vite/security/advisories/GHSA-fx2h-pf6j-xcff"},{"url":"https://github.com/advisories/GHSA-fx2h-pf6j-xcff"}],"tags":["ghsa","npm","exploit-available"],"epss":0.00577,"epssPercentile":0.45989,"ingestedAt":"2026-07-07T15:41:58.939Z","exploits":{"github":1,"githubRepos":["https://github.com/TazmiDev/CVE-2026-53571"],"checkedAt":"2026-09-21T15:29:27.398Z"},"exploitAvailable":true,"slug":"CVE-2026-53571","body":"## Overview\n\n### Summary\n\nThe contents of files that are specified by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny) can be returned to the browser on Windows.\n\n### Impact\n\nOnly apps that match the following conditions are affected:\n\n- explicitly exposes the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host))\n- the sensitive file exists in the allowed directories specified by [`server.fs.allow`](https://vite.dev/config/server-options#server-fs-allow)\n- either of:\n  - the sensitive file exists in an NTFS volume\n  - the dev server is running on Windows and the sensitive file exists in a volume that 8.3 short name generation is enabled (it is enabled by default on system volumes)\n\n### Details\n\nVite’s dev server denies direct access to sensitive files through `server.fs.deny`, including entries such as `.env`, `.env.*`, and `*.{crt,pem}`. However, on Windows, the deny logic does not correctly normalize NTFS ADS path forms before access checks are applied.\nBecause of this, requests such as `/.env::$DATA?raw` are treated as allowed paths, while Windows resolves them to the original file's default data stream.\n\nSimilar to that, Windows allows accessing a file using a different name with the 8.3 short name compatibility feature. Vite did not reject accessing files via them.\n\n### PoC\n```bash\n$ npm create vite@latest\n$ cd vite-project/\n$ npm install\n$ npm run dev\n```\nAccess via browser at `http://localhost:5173/.env::$DATA?raw`\n<img width=\"388\" height=\"129\" alt=\"deecc1315123883cfd0f9c26a002845a\" src=\"https://github.com/user-attachments/assets/895c6012-4e2e-4a35-babb-69bbf3ee7170\" />\n\nExample expected result:\n- `/.env::$DATA?raw` returns the contents of `.env`\n- `/tls.pem::$DATA?raw` returns the contents of `tls.pem`\n\n## Affected packages\n\n- `vite >= 8.0.0, <= 8.0.15`\n- `vite >= 7.0.0, <= 7.3.4`\n- `vite <= 6.4.2`\n- `vite-plus <= 0.1.23`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `vite 8.0.16`\n- `vite 7.3.5`\n- `vite 6.4.3`\n- `vite-plus 0.1.24`","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":5325,"id":"CVE-2026-53571","ts":1788887266120,"field":"exploit_available","old":"false","new":"true"},{"seq":4208,"id":"CVE-2026-53571","ts":1788886380751,"field":"exploit_available","old":"true","new":"false"},{"seq":2967,"id":"CVE-2026-53571","ts":1788883045689,"field":"exploit_available","old":"false","new":"true"},{"seq":1996,"id":"CVE-2026-53571","ts":1788882449919,"field":"exploit_available","old":"true","new":"false"},{"seq":1072,"id":"CVE-2026-53571","ts":1788881886125,"field":"exploit_available","old":"false","new":"true"}]}