CVE-2026-53571

Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be returned to the browser on Windows. Vite’s dev server denies direct access to sensitive files through server.fs.deny, including entries such as .env, .env.*, and *.{crt,pem}. However, on Windows, the deny logic does not correctly normalize NTFS ADS path forms before access checks are applied. Because of this, requests such as /.env::$DATA?raw are treated as allowed paths, while Windows resolves them to the original file's default data stream. Similar to that, Windows allows accessing a file using a different name with the 8.3 short name compatibility feature. Vite did not reject accessing files via them. This vulnerability is fixed in 8.0.16, 7.3.5, and 6.4.3.

• CWE-22
• CWE-200

• https://github.com/vitejs/vite/security/advisories/GHSA-fx2h-pf6j-xcffExploit, Vendor Advisory
• https://github.com/vitejs/vite/security/advisories/GHSA-fx2h-pf6j-xcffExploit, Vendor Advisory

Published

Jun 22, 2026

Last Modified

Jun 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53551free5GC is an open-source implementation of the 5G core netw…6.9
• CVE-2026-5356The LatePoint – Calendar Booking Plugin for Appointments and…7.5
• CVE-2026-53565Improper Privilege Management vulnerability in Citrix Secure…8.5
• CVE-2026-53566Out-of-bounds read vulnerability in Citrix Citrix Secure Acc…6.8
• CVE-2026-53568Frappe is a full-stack web application framework. Prior to v…6.9
• CVE-2026-5357The Download Manager plugin for WordPress is vulnerable to S…6.4
• CVE-2026-53573GeoNetwork is a catalog application to manage spatially refe…4.8
• CVE-2026-53576Kestra is an open-source, event-driven orchestration platfor…10
• CVE-2026-53577Kestra is an open-source, event-driven orchestration platfor…6.5
• CVE-2026-5358Rejected reason: REJECTED: CVE-2026-5358 is rejected for two…
• CVE-2026-5359Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-53591FreeScout is a free help desk and shared inbox built with PH…8.6