PlatformPlansPartners
Resources
ToolsBlogDocs
Labs
CVE ForecastOpservantAll Research →
Sign Up →
medium·Product Based Web Vulnerabilities·Updated Apr 8, 2026

Vite Dev Server - Path Traversal in Optimized Deps .map Handling

Est. Time~10 seconds
Scan TypeGroup Scan
Targetsdomain, subdomain, ipv4
CostFree
2.6k
Times Used
continuous scan runs
0
Continuously Checked
assets under CS
0
Vulnerabilities Found
confirmed findings
References
CVECVE-2026-39365
6.3
CVSSmedium
Exploitable remotely over the internet · no authentication required.

Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow list and retrieve .map files located outside the project root, provided they can be parsed as valid source map JSON. This vulnerability is fixed in 6.4.2, 7.3.2, and 8.0.5.

Attack Vector
Network
Privileges Req.
None
User Interaction
None
Affected
viteby vitejs
>= 8.0.0, < 8.0.5
vite-plusby vitejs
< 0.1.16
Updated Sep 9, 2026View on NVD →
Similar Tools
medium
Vite - Path Traversal
→high
Vite Dev Server - Arbitrary File Read
→critical
WordPress Simple File List - Path Traversal
→medium
SAPControl ListConfigFiles - Disclosure
→high
Yonyou YonBIP - Path Traversal
→high
Spring Framework Path Traversal in Functional Web Frameworks
→critical
WordPress Madara Theme < 2.2.2.1 - Local File Inclusion
→critical
Yonyou U9 PatchFile.asmx - Unauthenticated Arbitrary File Upload
→

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.