CVE-2026-39364

CVE-2026-39364 is an authentication bypass vulnerability affecting Vite, a popular frontend build tool framework for JavaScript. The vulnerability exists in versions 7.1.0 through 7.3.1 and 8.0.0 through 8.0.4, allowing attackers to bypass the server.fs.deny file access restrictions on the development server. By appending query parameters such as ?raw, ?import&raw, or ?import&url&inline to requests, an attacker can retrieve sensitive files including environment configurations (.env) and certificates (*.crt) that should be blocked. The vulnerability has been remediated in versions 7.3.2 and 8.0.5. The vulnerability carries a CVSS 3.1 severity rating of 7.5 (HIGH), indicating significant risk. It requires no authentication or user interaction and can be exploited remotely with low complexity over a network. The attack results in high confidentiality impact through unauthorized information disclosure, though it does not affect system integrity or availability. The EPSS score of 0.036 places this vulnerability in the lower percentile of exploit probability compared to similar CVEs. There is currently no evidence of active exploitation in the wild or public exploit code availability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and community attention appears limited. Organizations using affected Vite versions should prioritize updating to patched releases, particularly those whose development environments handle sensitive configuration files or certificates.