{"id":"GHSA-fx2h-pf6j-xcff","summary":"vite: `server.fs.deny` bypass on Windows alternate paths","details":"### Summary\n\nThe contents of files that are specified by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny) can be returned to the browser on Windows.\n\n### Impact\n\nOnly apps that match the following conditions are affected:\n\n- explicitly exposes the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host))\n- the sensitive file exists in the allowed directories specified by [`server.fs.allow`](https://vite.dev/config/server-options#server-fs-allow)\n- either of:\n  - the sensitive file exists in an NTFS volume\n  - the dev server is running on Windows and the sensitive file exists in a volume that 8.3 short name generation is enabled (it is enabled by default on system volumes)\n\n### Details\n\nVite’s dev server denies direct access to sensitive files through `server.fs.deny`, including entries such as `.env`, `.env.*`, and `*.{crt,pem}`. However, on Windows, the deny logic does not correctly normalize NTFS ADS path forms before access checks are applied.\nBecause of this, requests such as `/.env::$DATA?raw` are treated as allowed paths, while Windows resolves them to the original file's default data stream.\n\nSimilar to that, Windows allows accessing a file using a different name with the 8.3 short name compatibility feature. Vite did not reject accessing files via them.\n\n### PoC\n```bash\n$ npm create vite@latest\n$ cd vite-project/\n$ npm install\n$ npm run dev\n```\nAccess via browser at `http://localhost:5173/.env::$DATA?raw`\n\u003cimg width=\"388\" height=\"129\" alt=\"deecc1315123883cfd0f9c26a002845a\" src=\"https://github.com/user-attachments/assets/895c6012-4e2e-4a35-babb-69bbf3ee7170\" /\u003e\n\nExample expected result:\n- `/.env::$DATA?raw` returns the contents of `.env`\n- `/tls.pem::$DATA?raw` returns the contents of `tls.pem`","aliases":["CVE-2026-53571"],"modified":"2026-09-10T03:50:49.380121960Z","published":"2026-06-15T17:17:45Z","database_specific":{"github_reviewed_at":"2026-06-15T17:17:45Z","nvd_published_at":"2026-06-22T18:16:44Z","cwe_ids":["CWE-200","CWE-22"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/vitejs/vite/security/advisories/GHSA-fx2h-pf6j-xcff"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53571"},{"type":"PACKAGE","url":"https://github.com/vitejs/vite"}],"affected":[{"package":{"name":"vite","ecosystem":"npm","purl":"pkg:npm/vite"},"ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.0.16"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 8.0.15","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-fx2h-pf6j-xcff/GHSA-fx2h-pf6j-xcff.json"}},{"package":{"name":"vite","ecosystem":"npm","purl":"pkg:npm/vite"},"ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.3.5"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 7.3.4","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-fx2h-pf6j-xcff/GHSA-fx2h-pf6j-xcff.json"}},{"package":{"name":"vite","ecosystem":"npm","purl":"pkg:npm/vite"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.4.3"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 6.4.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-fx2h-pf6j-xcff/GHSA-fx2h-pf6j-xcff.json"}},{"package":{"name":"vite-plus","ecosystem":"npm","purl":"pkg:npm/vite-plus"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.1.24"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 0.1.23","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-fx2h-pf6j-xcff/GHSA-fx2h-pf6j-xcff.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}