High severity · published Oct 21, 2026
CVE-2026-114063
SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunnel can send crafted requests to expose source code, configuration, or credentials readable by the server process.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KI
kit · sveltejs
2.10.0 before 3.0.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-114063
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-114063
github.com
https://github.com/sveltejs/kit/security/advisories/GHSA-xgrj-p7pg-6vm3
www.vulncheck.com
https://www.vulncheck.com/advisories/sveltekit-2.10.0-before-3.0.0-path-traversal-via-vite-preview-on-windows
More from kit
9.1
CVE-2025-67647
SvelteKit Denial of service and possible SSRF when using prerendering
7.5
CVE-2026-82261
SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization
7.5
CVE-2026-82260
SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization
7.5
CVE-2026-82259
SvelteKit 2.49.0 before 2.53.3 Denial of Service via form
7.5
CVE-2026-40074
SvelteKit's invalidated redirect in handle hook causes Denial-of-Service