---
id: CVE-2026-53571
aliases:
  - GHSA-fx2h-pf6j-xcff
title: 'vite: `server.fs.deny` bypass on Windows alternate paths'
summary: 'vite: `server.fs.deny` bypass on Windows alternate paths'
severity: high
cwe:
  - CWE-22
  - CWE-200
vendor: vite
product: vite
ecosystem: npm
affected:
  - 'vite >= 8.0.0, <= 8.0.15'
  - 'vite >= 7.0.0, <= 7.3.4'
  - vite <= 6.4.2
  - vite-plus <= 0.1.23
patched:
  - vite 8.0.16
  - vite 7.3.5
  - vite 6.4.3
  - vite-plus 0.1.24
published: '2026-06-15'
updated: '2026-06-15'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-fx2h-pf6j-xcff'
references:
  - url: 'https://github.com/vitejs/vite/security/advisories/GHSA-fx2h-pf6j-xcff'
  - url: 'https://github.com/advisories/GHSA-fx2h-pf6j-xcff'
tags:
  - ghsa
  - npm
  - exploit-available
epss: 0.00577
epssPercentile: 0.46272
ingestedAt: '2026-07-07T15:41:58.939Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/TazmiDev/CVE-2026-53571'
  checkedAt: '2026-09-24T07:53:06.601Z'
exploitAvailable: true
---

## Overview

### Summary

The contents of files that are specified by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny) can be returned to the browser on Windows.

### Impact

Only apps that match the following conditions are affected:

- explicitly exposes the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host))
- the sensitive file exists in the allowed directories specified by [`server.fs.allow`](https://vite.dev/config/server-options#server-fs-allow)
- either of:
  - the sensitive file exists in an NTFS volume
  - the dev server is running on Windows and the sensitive file exists in a volume that 8.3 short name generation is enabled (it is enabled by default on system volumes)

### Details

Vite’s dev server denies direct access to sensitive files through `server.fs.deny`, including entries such as `.env`, `.env.*`, and `*.{crt,pem}`. However, on Windows, the deny logic does not correctly normalize NTFS ADS path forms before access checks are applied.
Because of this, requests such as `/.env::$DATA?raw` are treated as allowed paths, while Windows resolves them to the original file's default data stream.

Similar to that, Windows allows accessing a file using a different name with the 8.3 short name compatibility feature. Vite did not reject accessing files via them.

### PoC
```bash
$ npm create vite@latest
$ cd vite-project/
$ npm install
$ npm run dev
```
Access via browser at `http://localhost:5173/.env::$DATA?raw`
<img width="388" height="129" alt="deecc1315123883cfd0f9c26a002845a" src="https://github.com/user-attachments/assets/895c6012-4e2e-4a35-babb-69bbf3ee7170" />

Example expected result:
- `/.env::$DATA?raw` returns the contents of `.env`
- `/tls.pem::$DATA?raw` returns the contents of `tls.pem`

## Affected packages

- `vite >= 8.0.0, <= 8.0.15`
- `vite >= 7.0.0, <= 7.3.4`
- `vite <= 6.4.2`
- `vite-plus <= 0.1.23`

## Remediation

Upgrade to a patched release:

- `vite 8.0.16`
- `vite 7.3.5`
- `vite 6.4.3`
- `vite-plus 0.1.24`