{"id":"ghsa-ghsa-rq7h-c2jc-7f22","seq":32744,"kind":"advisory","title":"Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine","url":"https://github.com/advisories/GHSA-rq7h-c2jc-7f22","permalink":"https://vulnpulse.app/items/ghsa-ghsa-rq7h-c2jc-7f22","summary":"影響: npm:vite >= 8.3.0, <= 8.3.2 → 8.3.3, npm:vite >= 8.2.0, <= 8.2.3 → 8.2.4, npm:vite >= 8.0.0, <= 8.1.5 → 8.1.6, npm:vite >= 7.0.0, <= 7.3.6 → 7.3.7, npm:vite <= 6.4.3 → 6.4.4, npm:vite-plus <= 1.0.0 → 1.1.0\nSummary The content of files outside server.fs setting can be returned to the browser if the project imports a file path concatenated with the root. For example, if the project references /etc/hosts, the content of /etc/hosts was possible to be returned. The content of files outside the server.fs.allow option can be returned to the browser when a project imports a file whose root-relative path matches an absolute path on the host. For example, referencing /etc/hosts could make Vite return the h…","severity":"medium","techs":["nodejs"],"cves":["CVE-2026-112946"],"tags":["GHSA-rq7h-c2jc-7f22","vite","vite","vite","vite","vite","vite-plus"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-21T16:47:42.000Z","fetched_at":"2026-10-21T18:28:52.985Z"}