NVD description: From 7.1.0 to before 7.3.2 and 8.0.5, files that server.fs.deny should block — .env, *.crt and similar — can be retrieved with HTTP 200 responses when crafted query parameters are appended to the request.

The operation exploits CVE-2026-39364, a high-severity flaw that bypasses file read and access controls in Vite versions 7.1.0 through 7.3.2 and the 8.x branch before 8.0.5, disclosed on 7 April.