---
id: "CVE-2026-112946"
kind: "vulnerability"
aliases: ["CVE-2026-112946", "GHSA-rq7h-c2jc-7f22"]
title: "Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine"
severity: "medium"
cvss: 6.3
epss: 0.008510000072419643
exploited: false
status: "open"
category: "package"
products: [{"name": "vite", "fixed": ["8.3.3"], "affected": ">= 8.3.0, <= 8.3.2", "ecosystem": "npm"}, {"name": "vite", "fixed": ["8.2.4"], "affected": ">= 8.2.0, <= 8.2.3", "ecosystem": "npm"}, {"name": "vite", "fixed": ["8.1.6"], "affected": ">= 8.0.0, <= 8.1.5", "ecosystem": "npm"}, {"name": "vite", "fixed": ["7.3.7"], "affected": ">= 7.0.0, <= 7.3.6", "ecosystem": "npm"}, {"name": "vite", "fixed": ["6.4.4"], "affected": "<= 6.4.3", "ecosystem": "npm"}, {"name": "vite-plus", "fixed": ["1.1.0"], "affected": "<= 1.0.0", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-22", "cwe-284", "dev-server", "non-windows", "npm", "package", "self-hosted", "vite"]
not_affected_if: ["default-config", "dev-server-bound-to-localhost", "fixed-version", "windows"]
published_at: "2026-10-20T16:17:05+00:00"
first_seen_at: "2026-10-23T19:11:32+00:00"
updated_at: "2026-10-23T21:57:20+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-rq7h-c2jc-7f22", "first_seen_at": "2026-10-23T19:11:32+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112946", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

Vite's dev server can serve a host file such as /etc/hostname to the browser when a project imports a file whose root-relative URL matches that absolute path, bypassing server.fs.allow. An attacker who can reach an exposed dev server can read files outside the project on non-Windows hosts.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:vite affected >= 8.3.0, <= 8.3.2 fixed 8.3.3
- npm:vite affected >= 8.2.0, <= 8.2.3 fixed 8.2.4
- npm:vite affected >= 8.0.0, <= 8.1.5 fixed 8.1.6
- npm:vite affected >= 7.0.0, <= 7.3.6 fixed 7.3.7
- npm:vite affected <= 6.4.3 fixed 6.4.4
- npm:vite-plus affected <= 1.0.0 fixed 1.1.0

## How to check

Check whether the dev server is started with --host or server.host set, e.g. grep -rn "host" vite.config.* package.json; then check the installed version with npm ls vite.
Run the dev server and request http://<host>:5173/@fs/etc/hostname to see if it returns the host file.
Affected only if the installed vite falls in the listed ranges.

## Fix

Upgrade vite to the fixed version for your release line: 8.3.3, 8.2.4, 8.1.6, 7.3.7, or 6.4.4; vite-plus to 1.1.0.
Until upgraded, do not expose the dev server with --host or server.host.

## Timeline

- 2026-10-23T19:11:32+00:00 ghsa https://github.com/advisories/GHSA-rq7h-c2jc-7f22
- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112946

## From the sources

### Summary

The content of files outside `server.fs` setting can be returned to the browser if the project imports a file path concatenated with the `root`. For example, if the project references `<path-to-project-root>/etc/hosts`, the content of `/etc/hosts` was possible to be returned.

The content of files outside the `server.fs.allow` option can be returned to the browser when a project imports a file whose root-relative path matches an absolute path on the host. For example, referencing `<project-root>/etc/hosts` could make Vite return the host's `/etc/hosts` file.

### Impact

Only apps that meet all of the following conditions are affected:

- explicitly expose the Vite dev server to the network (using `--host` or the [`server.host` option](https://vite.dev/config/server-options#server-host))
- contain an imported file whose root-relative browser URL is also the absolute path of a readable file on the host
- The sensitive file is not matched by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny)
- the dev server is not running on Windows

### Details

When Vite analyzes an in-root import, it rewrites the resolved module ID to a browser URL such as `/etc/hostname`. In affected versions, Vite converts that URL with `fsPathFromUrl` and adds the result to `safeModulePaths`. Because `fsPathFromUrl` ensures a leading slash without resolving the URL against the project root, the project URL `/etc/hostname` is recorded as if it were the absolute filesystem path `/etc/hostname`.

For a later request to `/@fs/etc/hostname`, the raw-filesystem middleware interprets `/etc/hostname` as an absolute path. The access check applies `server.fs.deny`, then accepts paths present in `safeModulePaths` before checking `server.fs.allow`. As a result, the request can return the host file instead of the project file that originally populated `safeModulePaths`.

### PoC
The following example requires Linux with a readable `/etc/hostname`:
```bash
$ mkdir vite-safe-module-path-poc
$ cd vite-safe-module-path-poc
$ npm init -y
$ npm install vite@8.3.1
$ mkdir -p etc
$ echo 'PROJECT-DECOY\n' > etc/hostname
$ echo 'import "./etc/hostname"\n' > main.js
$ npx vite --host 127.0.0.1
```

In another terminal:
```bash
$ curl -o /dev/null -s -w '%{http_code}\n' http://127.0.0.1:5173/main.js
200
$ curl -sS -o response -w '%{http_code}\n' http://127.0.0.1:5173/@fs/etc/hostname
200
$ cmp -s response /etc/hostname && echo 'response matches host file'
response matches host file
```

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_