SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunnel can send crafted requests to expose source code, configuration, or credentials readable by the server process.
Metrics
Affected Vendors & Products
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 21 Oct 2026 00:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunnel can send crafted requests to expose source code, configuration, or credentials readable by the server process. | |
| Title | SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows | |
| First Time appeared |
Svelte
Svelte kit |
|
| Weaknesses | CWE-22 | |
| CPEs | cpe:2.3:a:svelte:kit:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Svelte
Svelte kit |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-10-21T00:36:36.847Z
Reserved: 2026-10-20T21:43:23.218Z
Link: CVE-2026-114063
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-21T01:17:29.600
Modified: 2026-10-21T01:17:29.600
Link: CVE-2026-114063
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses