GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Common Weakness Enumeration

CWE-50

Allowed

Path Equivalence: '//multiple/leading/slash'

Abstraction: Variant · Status: Incomplete

API response cwe.mitre.org

The product accepts path input in the form of multiple leading slash ('//multiple/leading/slash') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

3 vulnerabilities reference this CWE, most recent first.

CVE-2026-66835 (GCVE-0-2026-66835)

Vulnerability from cvelistv5 – Published: 2026-09-01 14:49 – Updated: 2026-09-08 01:08
VLAI
Title
httpd mod_auth directory protection bypassed by a doubled slash in the request path
Summary
Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by prefixing the request path with an extra slash. httpd_request:validate_uri/1 normalises the request URI with uri_string:normalize/1, which performs RFC 3986 dot-segment removal but does not collapse empty path segments, so a doubled slash survives. mod_alias:real_name/3 concatenates the document root with that URI, and mod_auth:secret_path/3 then decides whether the result lies inside a protected directory block by running the configured directory path as an unanchored regular expression against it. The doubled slash breaks the contiguous substring the regex needs, so the request is treated as unprotected and no authentication challenge is issued, while mod_get opens the same path and the operating system collapses the doubled slash and returns the protected file. The same path mismatch also evades the per-path accounting in mod_security. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.
Severity
8.2 (High)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 17:57 UTC
CWE
  • CWE-50 - Path Equivalence: '//multiple/leading/slash'
Assigner
References
Impacted products
Vendor Product Version
Erlang OTP Unknown: 0 , < 17.0 (otp)
Affected: 17.0 , < 27.3.4.17 (otp)
Affected: 28.0 , < 28.5.0.6 (otp)
Affected: 29.0 , < 29.0.6 (otp)
    cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
Create a notification for this product.
Erlang OTP Unknown: 0 , < 5.10 (otp)
Affected: 5.10 , < 9.3.2.7 (otp)
Affected: 9.4 , < 9.6.2.3 (otp)
Affected: 9.7 , < 9.7.2 (otp)
    cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
Create a notification for this product.
Erlang OTP Affected: 84adefa331c4159d432d22840663c38f155cd4c1 , < * (git)
    cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
Arthur Chan / Ada Logics David Korczynski / Ada Logics Adam Korczynski / Ada Logics Konrad Pietrzak / Ericsson
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-66835",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-01T17:57:48.578657Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-01T17:58:31.739Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "mod_auth",
            "mod_alias",
            "httpd_request"
          ],
          "packageName": "otp",
          "packageURL": "pkg:software-id/erlang.org/otp",
          "product": "OTP",
          "programFiles": [
            "lib/inets/src/http_server/mod_auth.erl",
            "lib/inets/src/http_server/mod_alias.erl",
            "lib/inets/src/http_server/httpd_request.erl"
          ],
          "programRoutines": [
            {
              "name": "mod_auth:secret_path/3"
            },
            {
              "name": "mod_alias:real_name/3"
            },
            {
              "name": "httpd_request:validate_uri/1"
            }
          ],
          "vendor": "Erlang",
          "versions": [
            {
              "lessThan": "17.0",
              "status": "unknown",
              "version": "0",
              "versionType": "otp"
            },
            {
              "lessThan": "27.3.4.17",
              "status": "affected",
              "version": "17.0",
              "versionType": "otp"
            },
            {
              "lessThan": "28.5.0.6",
              "status": "affected",
              "version": "28.0",
              "versionType": "otp"
            },
            {
              "lessThan": "29.0.6",
              "status": "affected",
              "version": "29.0",
              "versionType": "otp"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "mod_auth",
            "mod_alias",
            "httpd_request"
          ],
          "packageName": "inets",
          "packageURL": "pkg:otp/inets",
          "product": "OTP",
          "programFiles": [
            "src/http_server/mod_auth.erl",
            "src/http_server/mod_alias.erl",
            "src/http_server/httpd_request.erl"
          ],
          "programRoutines": [
            {
              "name": "mod_auth:secret_path/3"
            },
            {
              "name": "mod_alias:real_name/3"
            },
            {
              "name": "httpd_request:validate_uri/1"
            }
          ],
          "repo": "https://github.com/erlang/otp",
          "vendor": "Erlang",
          "versions": [
            {
              "lessThan": "5.10",
              "status": "unknown",
              "version": "0",
              "versionType": "otp"
            },
            {
              "lessThan": "9.3.2.7",
              "status": "affected",
              "version": "5.10",
              "versionType": "otp"
            },
            {
              "lessThan": "9.6.2.3",
              "status": "affected",
              "version": "9.4",
              "versionType": "otp"
            },
            {
              "lessThan": "9.7.2",
              "status": "affected",
              "version": "9.7",
              "versionType": "otp"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "mod_auth",
            "mod_alias",
            "httpd_request"
          ],
          "packageName": "erlang/otp",
          "packageURL": "pkg:github/erlang/otp",
          "product": "OTP",
          "programFiles": [
            "lib/inets/src/http_server/mod_auth.erl",
            "lib/inets/src/http_server/mod_alias.erl",
            "lib/inets/src/http_server/httpd_request.erl"
          ],
          "programRoutines": [
            {
              "name": "mod_auth:secret_path/3"
            },
            {
              "name": "mod_alias:real_name/3"
            },
            {
              "name": "httpd_request:validate_uri/1"
            }
          ],
          "repo": "https://github.com/erlang/otp",
          "vendor": "Erlang",
          "versions": [
            {
              "changes": [
                {
                  "at": "bac19eb3dbd96cc49b6d8cabc1c04248bf8c79f6",
                  "status": "unaffected"
                },
                {
                  "at": "d8878dec0ececc2eab18e47bb18b472f224ca633",
                  "status": "unaffected"
                },
                {
                  "at": "9641944a2efbf55bea760f8ff7ba777fe3a0961c",
                  "status": "unaffected"
                }
              ],
              "lessThan": "*",
              "status": "affected",
              "version": "84adefa331c4159d432d22840663c38f155cd4c1",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eOnly servers that protect a directory with \u003ccode\u003emod_auth\u003c/code\u003e, by configuring a \u003ccode\u003edirectory\u003c/code\u003e block with authentication requirements, are affected. A server that serves no authenticated directory has no protection for this issue to bypass.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Only servers that protect a directory with `mod_auth`, by configuring a `directory` block with authentication requirements, are affected. A server that serves no authenticated directory has no protection for this issue to bypass."
            }
          ],
          "value": "Only servers that protect a directory with mod_auth, by configuring a directory block with authentication requirements, are affected. A server that serves no authenticated directory has no protection for this issue to bypass."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "27.3.4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "28.5.0.6",
                  "versionStartIncluding": "28.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "29.0.6",
                  "versionStartIncluding": "29.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Arthur Chan / Ada Logics"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "David Korczynski / Ada Logics"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Adam Korczynski / Ada Logics"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Konrad Pietrzak / Ericsson"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003ePath Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a \u003ccode\u003emod_auth\u003c/code\u003e protected directory by prefixing the request path with an extra slash.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003ehttpd_request:validate_uri/1\u003c/code\u003e normalises the request URI with \u003ccode\u003euri_string:normalize/1\u003c/code\u003e, which performs RFC 3986 dot-segment removal but does not collapse empty path segments, so a doubled slash survives. \u003ccode\u003emod_alias:real_name/3\u003c/code\u003e concatenates the document root with that URI, and \u003ccode\u003emod_auth:secret_path/3\u003c/code\u003e then decides whether the result lies inside a protected \u003ccode\u003edirectory\u003c/code\u003e block by running the configured directory path as an unanchored regular expression against it. The doubled slash breaks the contiguous substring the regex needs, so the request is treated as unprotected and no authentication challenge is issued, while \u003ccode\u003emod_get\u003c/code\u003e opens the same path and the operating system collapses the doubled slash and returns the protected file. The same path mismatch also evades the per-path accounting in \u003ccode\u003emod_security\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThis issue affects OTP from OTP\u0026nbsp;17.0 before OTP\u0026nbsp;27.3.4.17, from OTP\u0026nbsp;28.0 before OTP\u0026nbsp;28.5.0.6, and from OTP\u0026nbsp;29.0 before OTP\u0026nbsp;29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP\u0026nbsp;17.0, corresponding to inets before 5.10, is affected is unknown.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a `mod_auth` protected directory by prefixing the request path with an extra slash.\n\n`httpd_request:validate_uri/1` normalises the request URI with `uri_string:normalize/1`, which performs RFC 3986 dot-segment removal but does not collapse empty path segments, so a doubled slash survives. `mod_alias:real_name/3` concatenates the document root with that URI, and `mod_auth:secret_path/3` then decides whether the result lies inside a protected `directory` block by running the configured directory path as an unanchored regular expression against it. The doubled slash breaks the contiguous substring the regex needs, so the request is treated as unprotected and no authentication challenge is issued, while `mod_get` opens the same path and the operating system collapses the doubled slash and returns the protected file. The same path mismatch also evades the per-path accounting in `mod_security`.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a027.3.4.17, from OTP\u00a028.0 before OTP\u00a028.5.0.6, and from OTP\u00a029.0 before OTP\u00a029.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP\u00a017.0, corresponding to inets before 5.10, is affected is unknown."
            }
          ],
          "value": "Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by prefixing the request path with an extra slash.\n\nhttpd_request:validate_uri/1 normalises the request URI with uri_string:normalize/1, which performs RFC 3986 dot-segment removal but does not collapse empty path segments, so a doubled slash survives. mod_alias:real_name/3 concatenates the document root with that URI, and mod_auth:secret_path/3 then decides whether the result lies inside a protected directory block by running the configured directory path as an unanchored regular expression against it. The doubled slash breaks the contiguous substring the regex needs, so the request is treated as unprotected and no authentication challenge is issued, while mod_get opens the same path and the operating system collapses the doubled slash and returns the protected file. The same path mismatch also evades the per-path accounting in mod_security.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a027.3.4.17, from OTP\u00a028.0 before OTP\u00a028.5.0.6, and from OTP\u00a029.0 before OTP\u00a029.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP\u00a017.0, corresponding to inets before 5.10, is affected is unknown."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Path Traversal"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-50",
              "description": "CWE-50 Path Equivalence: \u0027//multiple/leading/slash\u0027",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T01:08:16.964Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/erlang/otp/security/advisories/GHSA-r4vv-vc2c-2fw6"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-66835.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-66835"
        },
        {
          "tags": [
            "x_version-scheme"
          ],
          "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/erlang/otp/commit/bac19eb3dbd96cc49b6d8cabc1c04248bf8c79f6"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/erlang/otp/commit/d8878dec0ececc2eab18e47bb18b472f224ca633"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/erlang/otp/commit/9641944a2efbf55bea760f8ff7ba777fe3a0961c"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "httpd mod_auth directory protection bypassed by a doubled slash in the request path"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-66835",
    "datePublished": "2026-09-01T14:49:47.805Z",
    "dateReserved": "2026-08-17T12:00:02.063Z",
    "dateUpdated": "2026-09-08T01:08:16.964Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-34092 (GCVE-0-2023-34092)

Vulnerability from cvelistv5 – Published: 2023-06-01 16:29 – Updated: 2025-01-08 21:13
VLAI
Title
Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)
Summary
Vite provides frontend tooling. Prior to versions 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and 4.3.9, Vite Server Options (`server.fs.deny`) can be bypassed using double forward-slash (//) allows any unauthenticated user to read file from the Vite root-path of the application including the default `fs.deny` settings (`['.env', '.env.*', '*.{crt,pem}']`). Only users explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected, and only files in the immediate Vite project root folder could be exposed. This issue is fixed in vite@4.3.9, vite@4.2.3, vite@4.1.5, vite@4.0.5, vite@3.2.7, and vite@2.9.16.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
SSVC
Exploitation: poc Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-01-08 21:13 UTC
CWE
  • CWE-50 - Path Equivalence: '//multiple/leading/slash'
  • CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
Impacted products
Vendor Product Version
vitejs vite Affected: < 2.9.16
Affected: >= 3.0.2, < 3.2.7
Affected: >= 4.0.0, < 4.0.5
Affected: >= 4.1.0, < 4.1.5
Affected: >= 4.2.0, < 4.2.3
Affected: >= 4.3.0, < 4.3.9
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T16:01:53.638Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/vitejs/vite/security/advisories/GHSA-353f-5xf4-qw67",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/vitejs/vite/security/advisories/GHSA-353f-5xf4-qw67"
          },
          {
            "name": "https://github.com/vitejs/vite/pull/13348",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/vitejs/vite/pull/13348"
          },
          {
            "name": "https://github.com/vitejs/vite/commit/813ddd6155c3d54801e264ba832d8347f6f66b32",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/vitejs/vite/commit/813ddd6155c3d54801e264ba832d8347f6f66b32"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-34092",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-08T21:13:03.335508Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-08T21:13:20.258Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vite",
          "vendor": "vitejs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.9.16"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.2, \u003c 3.2.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.0.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.1.0, \u003c 4.1.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.2.0, \u003c 4.2.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.3.0, \u003c 4.3.9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vite provides frontend tooling. Prior to versions 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and 4.3.9, Vite Server Options (`server.fs.deny`) can be bypassed using double forward-slash (//) allows any unauthenticated user to read file from the Vite root-path of the application including the default `fs.deny` settings (`[\u0027.env\u0027, \u0027.env.*\u0027, \u0027*.{crt,pem}\u0027]`). Only users explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected, and only files in the immediate Vite project root folder could be exposed. This issue is fixed in vite@4.3.9, vite@4.2.3, vite@4.1.5, vite@4.0.5, vite@3.2.7, and vite@2.9.16."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-50",
              "description": "CWE-50: Path Equivalence: \u0027//multiple/leading/slash\u0027",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-01T16:29:51.428Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vitejs/vite/security/advisories/GHSA-353f-5xf4-qw67",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vitejs/vite/security/advisories/GHSA-353f-5xf4-qw67"
        },
        {
          "name": "https://github.com/vitejs/vite/pull/13348",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitejs/vite/pull/13348"
        },
        {
          "name": "https://github.com/vitejs/vite/commit/813ddd6155c3d54801e264ba832d8347f6f66b32",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vitejs/vite/commit/813ddd6155c3d54801e264ba832d8347f6f66b32"
        }
      ],
      "source": {
        "advisory": "GHSA-353f-5xf4-qw67",
        "discovery": "UNKNOWN"
      },
      "title": "Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-34092",
    "datePublished": "2023-06-01T16:29:51.428Z",
    "dateReserved": "2023-05-25T21:56:51.244Z",
    "dateUpdated": "2025-01-08T21:13:20.258Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

GHSA-353F-5XF4-QW67

Vulnerability from github – Published: 2023-06-06 02:01 – Updated: 2024-08-09 19:14
VLAI
Summary
Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)
Details

The issue involves a security vulnerability in Vite where the server options can be bypassed using a double forward slash (//). This vulnerability poses a potential security risk as it can allow unauthorized access to sensitive directories and files.

Steps to Fix. Update Vite: Ensure that you are using the latest version of Vite. Security issues like this are often fixed in newer releases.\n2. Secure the server configuration: In your vite.config.js file, review and update the server configuration options to restrict access to unauthorized requests or directories.

Impact

Only users explicitly exposing the Vite dev server to the network (using --host or the server.host config option) are affected and only files in the immediate Vite project root folder could be exposed.\n\n### Patches\nFixed in vite@4.3.9, vite@4.2.3, vite@4.1.5, vite@4.0.5 and in the latest minors of the previous two majors, vite@3.2.7 and vite@2.9.16.

### Details Vite serves the application with under the root-path of the project while running on the dev mode. By default, Vite uses the server option fs.deny to protect sensitive files. But using a simple double forward-slash, we can bypass this restriction. \n\n### PoC\n1. Create a new latest project of Vite using any package manager. (here I'm using react and vue templates and pnpm for testing)\n2. Serve the application on dev mode using pnpm run dev.\n3. Directly access the file via url using double forward-slash (//) (e.g: //.env, //.env.local)\n4. The server option fs.deny was successfully bypassed.

Proof Images: proof-1\nproof-2

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "vite"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "vite"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.2"
            },
            {
              "fixed": "3.2.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "vite"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.0.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "vite"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.1.0"
            },
            {
              "fixed": "4.1.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "vite"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.2.0"
            },
            {
              "fixed": "4.2.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "vite"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.3.0"
            },
            {
              "fixed": "4.3.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-34092"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-50",
      "CWE-706"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-06-06T02:01:39Z",
    "nvd_published_at": "2023-06-01T17:15:10Z",
    "severity": "HIGH"
  },
  "details": "The issue involves a security vulnerability in Vite where the server options can be bypassed using a double forward slash (`//`). This vulnerability poses a potential security risk as it can allow unauthorized access to sensitive directories and files.\n\n### Steps to Fix. **Update Vite**: Ensure that you are using the latest version of Vite. Security issues like this are often fixed in newer releases.\\n2. **Secure the server configuration**: In your `vite.config.js` file, review and update the server configuration options to restrict access to unauthorized requests or directories.\n\n### Impact\nOnly users explicitly exposing the Vite dev server to the network (using `--host` or the [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host)) are affected and only files in the immediate Vite project root folder could be exposed.\\n\\n### Patches\\nFixed in vite@**4.3.9**, vite@**4.2.3**, vite@**4.1.5**, vite@**4.0.5** and in the latest minors of the previous two majors, vite@**3.2.7** and vite@**2.9.16**.\n\n ### Details \nVite serves the application with under the root-path of the project while running on the dev mode. By default, Vite uses the server option fs.deny to protect sensitive files. But using a simple double forward-slash, we can bypass this restriction. \\n\\n### PoC\\n1. Create a new latest project of Vite using any package manager. (here I\u0027m using react and vue templates and pnpm for testing)\\n2. Serve the application on dev mode using `pnpm run dev`.\\n3. Directly access the file via url using double forward-slash (`//`) (e.g: `//.env`, `//.env.local`)\\n4. The server option `fs.deny` was successfully bypassed.\n\nProof Images: ![proof-1](https://user-images.githubusercontent.com/30733517/241105344-6ecbc7f6-57b7-45c7-856a-6421a577dda1.png)\\n![proof-2](https://user-images.githubusercontent.com/30733517/241105349-ab9561e7-8aff-4f29-97f9-b784e673c122.png)",
  "id": "GHSA-353f-5xf4-qw67",
  "modified": "2024-08-09T19:14:57Z",
  "published": "2023-06-06T02:01:39Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vitejs/vite/security/advisories/GHSA-353f-5xf4-qw67"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34092"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitejs/vite/pull/13348"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vitejs/vite/commit/813ddd6155c3d54801e264ba832d8347f6f66b32"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vitejs/vite"
    },
    {
      "type": "WEB",
      "url": "https://security.snyk.io/package/npm/vite/3.2.0-beta.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)"
}

No mitigation information available for this CWE.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list