The vulnerability allows an attacker to retrieve source map files that reside outside the project root by manipulating the URL path sent to a Vite development server. When the server processes a .map request, it resolves the requested file path without removing relative "../" segments, then directly reads the file without enforcing the strict file‑system allow list. As a result, an adversary can obtain any source map JSON that can be parsed from directories beyond the intended project boundaries, potentially revealing source code or development information. This weakness corresponds to the directory traversal flaw described by CWE‑22.

Vite releases from 6.0.0 up to but excluding 6.4.2, all releases before 7.3.2, and all releases before 8.0.5 are affected. The flaw is in the core Vite framework and its extensions managed by the vitejs organization, including vite-plus. Any deployment that runs the development server with one of these versions is vulnerable.

The CVSS score of 6.3 classifies this as moderate severity. The EPSS score of 1% indicates a low but nonzero probability that the vulnerability is exploited. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. Based on the description, it is inferred that the likely attack vector would be an unauthenticated HTTP request sent to the development server, which typically serves only local developers but could be exposed to external networks. An attacker exploiting this flaw could read arbitrary source map files outside the project, exposing internal code and debugging data. While no public exploit has been reported, the potential for source disclosure makes timely remediation important.