Is there a public PoC exploit available for CVE-2026-39365?

Yes, a public proof-of-concept exploit is available for CVE-2026-39365. Prioritise patching immediately. EPSS: 3.1%.

Is there a patch available for CVE-2026-39365?

Yes, a patch is available for CVE-2026-39365. Update the affected software to the latest version immediately.

CVE-2026-39365

Q: What is the CVSS score of CVE-2026-39365?

CVE-2026-39365 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 3.1%.

EUVD-2026-19875 MEDIUM

Path Traversal (CWE-22)

2026-04-06 https://github.com/vitejs/vite

GHSA-4w7w-66w2-5vf9

Path Traversal

6.3

CVSS 4.0 · Vendor: https://github.com/vitejs/vite

Severity by source

Vendor (https://github.com/vitejs/vite) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Red Hat

5.3 MEDIUM

qualitative

Primary rating from Vendor (https://github.com/vitejs/vite).

CVSS VectorVendor: https://github.com/vitejs/vite

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Apr 07, 2026 - 14:30 euvd

EUVD-2026-19875

Analysis Generated

Apr 07, 2026 - 14:30 vuln.today

Patch released

Apr 07, 2026 - 14:30 nvd

Patch available

CVE Published

Apr 06, 2026 - 18:03 nvd

MEDIUM 6.3

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

34 npm packages depend on vite (30 direct, 4 indirect)

Ecosystem-wide dependent count for version 8.0.0.

DescriptionCVE.org

Summary

Any files ending with .map even out side the project can be returned to the browser.

Impact

Only apps that match the following conditions are affected:

explicitly exposes the Vite dev server to the network (using --host or server.host config option)
have a sensitive content in files ending with .map and the path is predictable

Details

In Vite v7.3.1, the dev server’s handling of .map requests for optimized dependencies resolves file paths and calls readFile without restricting ../ segments in the URL. As a result, it is possible to bypass the server.fs.strict allow list and retrieve .map files located outside the project root, provided they can be parsed as valid source map JSON.

PoC

Create a minimal PoC sourcemap outside the project root

bash

    cat > /tmp/poc.map <<'EOF'
    {"version":3,"file":"x.js","sources":[],"names":[],"mappings":""}
    EOF

Start the Vite dev server (example)

bash

    pnpm -C playground/fs-serve dev --host 127.0.0.1 --port 18080

Confirm that direct /@fs access is blocked by strict (returns 403)

Inject ../ segments under the optimized deps .map URL prefix to reach /tmp/poc.map

AnalysisAI

Path traversal in Vite dev server versions 6.x through 7.3.1 allows unauthenticated remote attackers to bypass filesystem restrictions and retrieve sensitive .map files outside the project root by injecting path traversal sequences into optimized dependency URLs. The vulnerability requires explicit network exposure of the dev server and predictable file paths, but publicly available proof-of-concept code demonstrates the attack. Affected Vite instances should upgrade to v6.4.2, v7.3.2, or v8.0.5.

Technical ContextAI

Vite is a build tool and development server for modern JavaScript applications. The vulnerability exists in the dev server's request handler for source map files (.map) associated with optimized dependencies. The root cause (CWE-22: Improper Limitation of a Pathname to a Restricted Directory) stems from insufficient path normalization when processing .map file requests. The code resolves file paths and calls readFile without stripping or validating ../ (parent directory) sequences in the URL, allowing traversal past the intended root directory boundary. This bypasses the server.fs.strict configuration option, which is designed to restrict file access to an allow list. The vulnerability affects npm package vite across multiple major versions via the affected CPE strings.

RemediationAI

Upgrade Vite to a patched version: v6.4.2 or later for the 6.x branch, v7.3.2 or later for the 7.x branch, or v8.0.5 or later for the 8.x branch. The upstream fix is available in PR #22161 and commit 79f002f2286c03c88c7b74c511c7f9fc6dc46694 (https://github.com/vitejs/vite/pull/22161). As an immediate workaround, restrict network exposure of the dev server by not using --host or by binding to localhost only via server.host: 'localhost' in the Vite config. Ensure the dev server is never exposed to untrusted networks. For environments that must expose the dev server, apply the patch immediately and validate that .map files containing sensitive information are not stored at predictable paths outside the project root.