{"id":"CVE-2024-23331","aliases":["CLSA-2026-1784683083","CLSA-2026-1789031855","CLSA-2026-1792163424","CLSA-2026-1792225953","EUVD-2024-0322","GHSA-c24v-8rfc-w8vw","openSUSE-SU-2025:14663-1"],"status":"published","title":"Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem","description":"Vite is a frontend tooling framework for javascript. The Vite dev server option `server.fs.deny` can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to CVE-2023-34092 -- with surface area reduced to hosts having case-insensitive filesystems. Since `picomatch` defaults to case-sensitive glob matching, but the file server doesn't discriminate; a blacklist bypass is possible. By requesting raw filesystem paths using augmented casing, the matcher derived from `config.server.fs.deny` fails to block access to sensitive files. This issue has been addressed in vite@5.0.12, vite@4.5.2, vite@3.2.8, and vite@2.9.17. Users are advised to upgrade. Users unable to upgrade should restrict access to dev servers.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00785,"percentile":0.5634,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-178","CWE-200","CWE-284"],"published":"2024-01-19T19:43:17Z","modified":"2026-11-04T10:45:12Z","fixes":[{"ecosystem":"npm","package":"vite","fixed_in":["2.9.17","3.2.8","4.5.2","5.0.12"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"last_affected":"2.9.16"},{"fixed":"2.9.17"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"last_affected":"3.2.7"},{"fixed":"3.2.8"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"last_affected":"4.5.1"},{"fixed":"4.5.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"last_affected":"5.0.11"},{"fixed":"5.0.12"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.18-tuxcare.0"},{"fixed":"2.9.18-tuxcare.2"}]}],"versions":["2.9.18","2.9.18-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.5-tuxcare.0"},{"fixed":"4.1.5-tuxcare.1"}]}],"versions":["4.1.5"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0-tuxcare.0"},{"fixed":"4.5.0-tuxcare.4"}]}],"versions":["4.5.0","4.5.0-tuxcare.1","4.5.0-tuxcare.2","4.5.0-tuxcare.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@vitejs/plugin-react","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.18-tuxcare.0"},{"fixed":"2.9.18-tuxcare.2"}]}],"versions":["2.9.18","2.9.18-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"2.7.0"},{"fixed":"2.9.17"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.2.8"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.5.2"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"5.0.12"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"velociraptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0.4.git142.862ef23-1.1"}]}],"bundled":27}],"products":[{"vendor":"vitejs","product":"vite"}],"references":[{"url":"https://github.com/vitejs/vite/security/advisories/GHSA-c24v-8rfc-w8vw","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/vitejs/vite/commit/91641c4da0a011d4c5352e88fc68389d4e1289a5","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://vitejs.dev/config/server-options.html#server-fs-deny","tags":["x_refsource_MISC","x_transferred","Product","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-34092","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23331","tags":["advisory"]},{"url":"https://github.com/vitejs/vite/commit/0cd769c279724cf27934b1270fbdd45d68217691","tags":["web"]},{"url":"https://github.com/vitejs/vite/commit/a26c87d20f9af306b5ce3ff1648be7fa5146c278","tags":["web"]},{"url":"https://github.com/vitejs/vite/commit/eeec23bbc9d476c54a3a6d36e78455867185a7cb","tags":["web"]},{"url":"https://github.com/advisories/GHSA-c24v-8rfc-w8vw"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23331.json","tags":["advisory"]},{"url":"https://github.com/vitejs/vite","tags":["package"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IL7QOYRPFRGRS6UKU6ZYHI76FWFFUJNK/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-1732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-44270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45683","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-28180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-31207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-37298","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-4067","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-4068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42461","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48949","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-51744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6104","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-23331","title":"Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem","description":"Vite is a frontend tooling framework for javascript. The Vite dev server option `server.fs.deny` can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to CVE-2023-34092 -- with surface area reduced to hosts having case-insensitive filesystems. Since `picomatch` defaults to case-sensitive glob matching, but the file server doesn't discriminate; a blacklist bypass is possible. By requesting raw filesystem paths using augmented casing, the matcher derived from `config.server.fs.deny` fails to block access to sensitive files. This issue has been addressed in vite@5.0.12, vite@4.5.2, vite@3.2.8, and vite@2.9.17. Users are advised to upgrade. Users unable to upgrade should restrict access to dev servers.","status":"published","published":"2024-01-19T19:43:17.404Z","modified":"2025-06-17T21:19:25.323Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-178","CWE-200","CWE-284"],"updated_at":"2026-11-02T14:34:05.444281Z"}],"euvd":[{"id":"EUVD-2024-0322","description":"Vite is a frontend tooling framework for javascript. The Vite dev server option `server.fs.deny` can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to CVE-2023-34092 -- with surface area reduced to hosts having case-insensitive filesystems. Since `picomatch` defaults to case-sensitive glob matching, but the file server doesn't discriminate; a blacklist bypass is possible. By requesting raw filesystem paths using augmented casing, the matcher derived from `config.server.fs.deny` fails to block access to sensitive files. This issue has been addressed in vite@5.0.12, vite@4.5.2, vite@3.2.8, and vite@2.9.17. Users are advised to upgrade. Users unable to upgrade should restrict access to dev servers.","status":"published","published":"2024-01-19T19:43:17Z","modified":"2025-06-17T21:19:25Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T20:32:21.000623Z"}],"ghsa":[{"id":"GHSA-c24v-8rfc-w8vw","title":"Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem","description":"### Summary\n[Vite dev server option](https://vitejs.dev/config/server-options.html#server-fs-deny) `server.fs.deny` can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows.\n\nThis bypass is similar to https://nvd.nist.gov/vuln/detail/CVE-2023-34092 -- with surface area reduced to hosts having case-insensitive filesystems.\n\n### Patches\nFixed in vite@5.0.12, vite@4.5.2, vite@3.2.8, vite@2.9.17\n\n### Details\nSince `picomatch` defaults to case-sensitive glob matching, but the file server doesn't discriminate; a blacklist bypass is possible. \n\nSee `picomatch`  usage, where `nocase` is defaulted to `false`: https://github.com/vitejs/vite/blob/v5.1.0-beta.1/packages/vite/src/node/server/index.ts#L632\n\nBy requesting raw filesystem paths using augmented casing, the matcher derived from `config.server.fs.deny` fails to block access to sensitive files. \n\n### PoC\n**Setup**\n1. Created vanilla Vite project using `npm create vite@latest` on a Standard Azure hosted Windows 10 instance. \n    - `npm run dev -- --host 0.0.0.0`\n    - Publicly accessible for the time being here: http://20.12.242.81:5173/ \n2. Created dummy secret files, e.g. `custom.secret` and `production.pem`\n3. Populated `vite.config.js` with\n```javascript\nexport default { server: { fs: { deny: ['.env', '.env.*', '*.{crt,pem}', 'custom.secret'] } } }\n```\n\n**Reproduction**\n1. `curl -s http://20.12.242.81:5173/@fs//`\n    - Descriptive error page reveals absolute filesystem path to project root\n2. `curl -s http://20.12.242.81:5173/@fs/C:/Users/darbonzo/Desktop/vite-project/vite.config.js`\n    - Discoverable configuration file reveals locations of secrets\n3. `curl -s http://20.12.242.81:5173/@fs/C:/Users/darbonzo/Desktop/vite-project/custom.sEcReT`\n    - Secrets are directly accessible using case-augmented version of filename\n\n**Proof**\n![Screenshot 2024-01-19 022736](https://user-images.githubusercontent.com/907968/298020728-3a8d3c06-fcfd-4009-9182-e842f66a6ea5.png)\n\n### Impact\n**Who**\n- Users with exposed dev servers on environments with case-insensitive filesystems\n\n**What**\n- Files protected by `server.fs.deny` are both discoverable, and accessible","status":"published","published":"2024-01-19T21:58:47Z","modified":"2024-01-19T21:58:48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-178","CWE-200","CWE-284"],"updated_at":"2026-11-02T14:37:31.550603Z"}],"nvd":[{"id":"CVE-2024-23331","description":"Vite is a frontend tooling framework for javascript. The Vite dev server option `server.fs.deny` can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to CVE-2023-34092 -- with surface area reduced to hosts having case-insensitive filesystems. Since `picomatch` defaults to case-sensitive glob matching, but the file server doesn't discriminate; a blacklist bypass is possible. By requesting raw filesystem paths using augmented casing, the matcher derived from `config.server.fs.deny` fails to block access to sensitive files. This issue has been addressed in vite@5.0.12, vite@4.5.2, vite@3.2.8, and vite@2.9.17. Users are advised to upgrade. Users unable to upgrade should restrict access to dev servers.","status":"published","published":"2024-01-19T20:15:14.07Z","modified":"2026-06-17T07:12:36.707Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-178","CWE-200","CWE-284"],"updated_at":"2026-11-02T14:09:32.147098Z"}],"osv":[{"id":"CVE-2024-23331","title":"Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem","description":"Vite is a frontend tooling framework for javascript. The Vite dev server option `server.fs.deny` can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to CVE-2023-34092 -- with surface area reduced to hosts having case-insensitive filesystems. Since `picomatch` defaults to case-sensitive glob matching, but the file server doesn't discriminate; a blacklist bypass is possible. By requesting raw filesystem paths using augmented casing, the matcher derived from `config.server.fs.deny` fails to block access to sensitive files. This issue has been addressed in vite@5.0.12, vite@4.5.2, vite@3.2.8, and vite@2.9.17. Users are advised to upgrade. Users unable to upgrade should restrict access to dev servers.","status":"published","published":"2024-01-19T19:43:17.404Z","modified":"2026-11-04T10:45:12.13032272Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-178","CWE-200","CWE-284"],"updated_at":"2026-11-04T11:07:20.833685Z"},{"id":"GHSA-c24v-8rfc-w8vw","title":"Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem","description":"### Summary\n[Vite dev server option](https://vitejs.dev/config/server-options.html#server-fs-deny) `server.fs.deny` can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows.\n\nThis bypass is similar to https://nvd.nist.gov/vuln/detail/CVE-2023-34092 -- with surface area reduced to hosts having case-insensitive filesystems.\n\n### Patches\nFixed in vite@5.0.12, vite@4.5.2, vite@3.2.8, vite@2.9.17\n\n### Details\nSince `picomatch` defaults to case-sensitive glob matching, but the file server doesn't discriminate; a blacklist bypass is possible. \n\nSee `picomatch`  usage, where `nocase` is defaulted to `false`: https://github.com/vitejs/vite/blob/v5.1.0-beta.1/packages/vite/src/node/server/index.ts#L632\n\nBy requesting raw filesystem paths using augmented casing, the matcher derived from `config.server.fs.deny` fails to block access to sensitive files. \n\n### PoC\n**Setup**\n1. Created vanilla Vite project using `npm create vite@latest` on a Standard Azure hosted Windows 10 instance. \n    - `npm run dev -- --host 0.0.0.0`\n    - Publicly accessible for the time being here: http://20.12.242.81:5173/ \n2. Created dummy secret files, e.g. `custom.secret` and `production.pem`\n3. Populated `vite.config.js` with\n```javascript\nexport default { server: { fs: { deny: ['.env', '.env.*', '*.{crt,pem}', 'custom.secret'] } } }\n```\n\n**Reproduction**\n1. `curl -s http://20.12.242.81:5173/@fs//`\n    - Descriptive error page reveals absolute filesystem path to project root\n2. `curl -s http://20.12.242.81:5173/@fs/C:/Users/darbonzo/Desktop/vite-project/vite.config.js`\n    - Discoverable configuration file reveals locations of secrets\n3. `curl -s http://20.12.242.81:5173/@fs/C:/Users/darbonzo/Desktop/vite-project/custom.sEcReT`\n    - Secrets are directly accessible using case-augmented version of filename\n\n**Proof**\n![Screenshot 2024-01-19 022736](https://user-images.githubusercontent.com/907968/298020728-3a8d3c06-fcfd-4009-9182-e842f66a6ea5.png)\n\n### Impact\n**Who**\n- Users with exposed dev servers on environments with case-insensitive filesystems\n\n**What**\n- Files protected by `server.fs.deny` are both discoverable, and accessible","status":"published","published":"2024-01-19T21:58:47Z","modified":"2026-09-10T03:49:24.667053987Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-178","CWE-200","CWE-284"],"updated_at":"2026-11-02T15:46:44.225359Z"},{"id":"CLSA-2026-1784683083","title":"TuxCare security update for vite (6 CVEs)","description":"TuxCare rebuilt vite to address 6 CVEs. Fixed in 2.9.18-tuxcare.2.","status":"published","published":"2026-08-04T14:52:47Z","modified":"2026-10-30T19:46:01.439880797Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1789031855","title":"TuxCare security update for vite (16 CVEs)","description":"TuxCare rebuilt vite to address 16 CVEs. Fixed in 4.1.5-tuxcare.1.","status":"published","published":"2026-09-10T09:17:35Z","modified":"2026-10-15T09:47:55.69239765Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1792163424","title":"TuxCare security update for vite (4 CVEs)","description":"TuxCare rebuilt vite to address 4 CVEs. Fixed in 4.5.0-tuxcare.4.","status":"published","published":"2026-10-16T15:10:24Z","modified":"2026-10-16T16:31:39.757399382Z","updated_at":"2026-11-02T15:43:51.466048Z"},{"id":"CLSA-2026-1792225953","title":"TuxCare security update for @vitejs/plugin-react (7 CVEs)","description":"TuxCare rebuilt @vitejs/plugin-react to address 7 CVEs. Fixed in 2.9.18-tuxcare.2.","status":"published","published":"2026-10-17T08:32:31Z","modified":"2026-10-17T13:09:24.727766679Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"openSUSE-SU-2025:14663-1","title":"velociraptor-0.7.0.4.git142.862ef23-1.1 on GA media","description":"These are all security issues fixed in the velociraptor-0.7.0.4.git142.862ef23-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-01-17T00:00:00Z","modified":"2026-02-04T03:47:20.18775Z","updated_at":"2026-11-02T16:58:36.976155Z"}]}}