CVE-2026-114063: SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows
SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunnel can send crafted requests to expose source code, configuration, or credentials readable by the server process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@sveltejs/kitto a version that resolves this vulnerability.Fixed in 3.0.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Windows deployments using @sveltejs/kit versions from 2.10.0 up to, but not including, 3.0.0 are affected when the Vite preview server is reachable over the network or through a tunnel.
Does exploitation require authentication or user interaction?
No. An unauthenticated attacker can exploit the issue by sending crafted requests to a reachable preview server; no user interaction is required.
What could an attacker obtain?
An attacker may read files outside the prerendered output directory that are readable by the server process, including source code, configuration, or credentials.