Vite's import analysis can record a root‑relative browser URL in safeModulePaths instead of the expected resolved module identifier. When this occurs on a network‑accessible development server that is not running on Windows, an imported project file whose URL matches an absolute host path can authorize a later raw‑filesystem request for that host file. This allows a disclosure of a file located outside the project root, though it does not permit arbitrary path traversal because the host path must correspond to a project‑relative URL in the application graph. The primary consequence is the confidential disclosure of host files that match project URLs, exposing sensitive data without granting broader filesystem access.

The vulnerability affects Vite and Vite‑Plus from vitejs, for all releases prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3. Upgrading to these or later versions removes the flaw.

The CVSS score of 6.3 indicates a medium severity. EPSS data is not available, and the vulnerability is not listed in CISA's KEV catalog. The attack vector is a network‑accessible, non‑Windows development server; the attacker must host a project file whose URL resolves to an absolute host path and rely on server.fs.deny not blocking raw‑filesystem requests. The exploitation does not enable full path traversal, so the risk is confined to accidental disclosure of matched files. The impact aligns with seen user‑controlled disclosure rather than arbitrary code execution.