CVE-2026-114063: SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows

Q: Which deployments are exposed?

Windows deployments using @sveltejs/kit versions from 2.10.0 up to, but not including, 3.0.0 are affected when the Vite preview server is reachable over the network or through a tunnel.

Q: Does exploitation require authentication or user interaction?

No. An unauthenticated attacker can exploit the issue by sending crafted requests to a reachable preview server; no user interaction is required.

Q: What could an attacker obtain?

An attacker may read files outside the prerendered output directory that are readable by the server process, including source code, configuration, or credentials.

Published Oct 21, 2026

Updated

SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunnel can send crafted requests to expose source code, configuration, or credentials readable by the server process.

Affected Software

1 affected component

npm/@sveltejs/kit>=2.10.0<3.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade @sveltejs/kit to a version that resolves this vulnerability.
Fixed in 3.0.0

Event History

Oct 21, 2026

CVE Published

via MITRE·12:36 AM

Data Sourced

via MITRE·12:36 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Windows deployments using @sveltejs/kit versions from 2.10.0 up to, but not including, 3.0.0 are affected when the Vite preview server is reachable over the network or through a tunnel.

Does exploitation require authentication or user interaction?

No. An unauthenticated attacker can exploit the issue by sending crafted requests to a reachable preview server; no user interaction is required.

What could an attacker obtain?

An attacker may read files outside the prerendered output directory that are readable by the server process, including source code, configuration, or credentials.

CVE-2026-114063: SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require authentication or user interaction?

What could an attacker obtain?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require authentication or user interaction?

What could an attacker obtain?