CVE-2026-114063
Awaiting Analysis Awaiting Analysis - Queue

Path Traversal in SvelteKit Vite Preview Server on Windows

Publication date: 2026-10-21

Last updated on: 2026-10-27

Assigner: VulnCheck

Description
SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunnel can send crafted requests to expose source code, configuration, or credentials readable by the server process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-21
Last Modified
2026-10-27
Generated
2026-11-10
AI Q&A
2026-10-22
EPSS Evaluated
2026-11-08
NVD
CVE-2026-114063
EUVD
EUVD-2026-107014

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sveltejs kit 2.10.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a path traversal vulnerability in SvelteKit's vite preview server on Windows systems. It affects versions 2.10.0 through 2.99.99 before 3.0.0. Unauthenticated attackers can send crafted requests to read files outside the intended prerendered output directory. This could expose sensitive files like source code, configurations, or credentials that the server process can access.

Detection Guidance

Check if your SvelteKit application is running a vulnerable version (2.10.0 to 2.99.99) on Windows by inspecting package.json for @sveltejs/kit version. Verify if the vite preview server is exposed to the network or internet, particularly on Windows systems.

Impact Analysis

Attackers who can access the preview server via network or tunnel may read sensitive files on your system. This includes source code, configuration files, or credentials readable by the server process. The impact depends on what files are accessible to the server process.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive files such as source code, configuration files, or credentials. If such data includes personally identifiable information (PII) or protected health information (PHI), it may violate GDPR or HIPAA compliance requirements by exposing confidential data to attackers.

Mitigation Strategies
  • Upgrade SvelteKit to version 3.0.0 or later to patch the vulnerability.
  • Restrict access to the vite preview server by binding it to localhost (127.0.0.1) instead of exposing it publicly.
  • Avoid using public tunnels or exposing the preview server to untrusted networks.
  • If possible, run the preview server on a non-Windows system to avoid the vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-114063. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...