{"id":"CVE-2026-118662","aliases":["GHSA-8g5g-mxqh-grgj"],"title":"Vite: `server.fs.deny` bypassed with queries","titleSource":"GitHub_M","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"### Summary\n\nThe contents of files that are specified by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny) can be returned to the browser. This is the same as https://github.com/vitejs/vite/security/advisories/GHSA-v2wj-q39q-566r.\n\n### Impact\n\nOnly apps that match the following conditions are affected:\n\n- explicitly exposes the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host))\n- the sensitive file exists in the allowed directories specified by [`server.fs.allow`](https://vite.dev/config/server-options#server-fs-allow)\n- the sensitive file is denied with a pattern that matches a file by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny)\n\n### Details\n\nOn the Vite dev server, files that should be blocked by `server.fs.deny` (e.g., `.env`, `*.crt`) can be retrieved with HTTP 200 responses when query parameters such as `?raw`, `?import&raw`, or `?import&url&inline` are appended.\n\nFor the fix for https://github.com/vitejs/vite/security/advisories/GHSA-rq7h-c2jc-7f22, v6.4.4 back-ported https://github.com/vitejs/vite/pull/20410. But while that PR requires https://github.com/vitejs/vite/pull/22160 for https://github.com/vitejs/vite/security/advisories/GHSA-v2wj-q39q-566r, https://github.com/vitejs/vite/pull/22160 wasn't back-ported together causing v6 vulnerable to https://github.com/vitejs/vite/security/advisories/GHSA-v2wj-q39q-566r.","severity":"medium","score":6.9,"published":"2026-10-28T20:33:36.440Z","modified":"2026-10-29T16:45:04.362Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"npm","name":"vite","sources":[{"name":"OSV · GHSA-8g5g-mxqh-grgj","url":"https://osv.dev/vulnerability/GHSA-8g5g-mxqh-grgj"}],"ranges":[{"events":[{"introduced":"6.4.4"},{"fixed":"6.4.5"}],"type":"SEMVER"}],"versions":["6.4.4"],"fixed":["6.4.5"]}],"sourceAffected":[],"references":["https://github.com/vitejs/vite/security/advisories/GHSA-8g5g-mxqh-grgj","https://github.com/vitejs/vite/pull/22160","https://github.com/vitejs/vite/pull/23855","https://github.com/vitejs/vite/commit/91e40d7bf9777057bbd31c3eb036a54c9465697e","https://github.com/vitejs/vite/releases/tag/v6.4.5","https://nvd.nist.gov/vuln/detail/CVE-2026-118662","https://github.com/vitejs/vite"],"sources":[{"name":"CVE","id":"CVE-2026-118662","modified":"2026-10-28T20:33:36.440Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-118662"},{"name":"OSV","id":"GHSA-8g5g-mxqh-grgj","modified":"2026-10-29T16:45:04.362575088Z","url":"https://osv.dev/vulnerability/GHSA-8g5g-mxqh-grgj"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","score":6.9},{"source":"OSV","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","score":6.9}],"cve":{"records":[{"id":"CVE-2026-118662","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-28T17:25:37.561Z","published":"2026-10-28T20:33:36.440Z","modified":"2026-10-28T20:33:36.440Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-28T20:33:36.440Z"}],"references":[{"url":"https://github.com/vitejs/vite/security/advisories/GHSA-8g5g-mxqh-grgj","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/vitejs/vite/pull/22160","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/vitejs/vite/pull/23855","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/vitejs/vite/commit/91e40d7bf9777057bbd31c3eb036a54c9465697e","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/vitejs/vite/releases/tag/v6.4.5","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-180","description":"CWE-180: Incorrect Behavior Order: Validate Before Canonicalize","source":"GitHub_M"},{"id":"CWE-284","description":"CWE-284: Improper Access Control","source":"GitHub_M"}],"applicability":[],"prioritization":[]},"products":[{"vendor":"vitejs","name":"vite","platforms":[],"versions":[{"version":">= 6.4.4, < 6.4.5","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-118662"}],"remediation":[],"observedAt":"2026-10-29T16:58:05.049Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T16:40:31.722Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-28T21:25:33.486Z","attemptedAt":"2026-10-28T21:25:33.486Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-28T21:25:33.598Z","attemptedAt":"2026-10-28T21:25:33.598Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-28T21:25:34.085Z","attemptedAt":"2026-10-28T21:25:34.085Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-28T21:25:33.105Z","attemptedAt":"2026-10-28T21:25:33.105Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-118662","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118662","modified":"2026-10-28T21:16:56.403","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-10-28T21:25:33.486Z"},{"source":"ENISA EUVD","id":"EUVD-2026-112469","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-112469","modified":"Oct 28, 2026, 8:33:36 PM","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","checkedAt":"2026-10-28T21:25:34.085Z"}],"aiSummary":{"text":"Vite dev server versions 6.4.4 to less than 6.4.5 are affected by a bypass of the `server.fs.deny` configuration, allowing access to sensitive files when query parameters are used. The vulnerability requires the Vite dev server to be exposed to the network and the sensitive file to be in an allowed directory. The impact is limited to apps that match specific conditions.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:58:19.471Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-118662"},{"name":"OSV","url":"https://osv.dev/vulnerability/GHSA-8g5g-mxqh-grgj"}]}}