CVE-2026-114063

HIGH 7.5

SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunnel can send crafted requests to expose source code, configuration, or credentials readable by the server process.

CWE	CWE-22
Vendor	sveltejs
Product	kit
Published	Oct 21, 2026

Stay Ahead of the Next One

Get instant alerts for sveltejs kit

Be the first to know when new high vulnerabilities affecting sveltejs kit are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

sveltejs / kit

2.10.0 < 3.0.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/sveltejs/kit/security/advisories/GHSA-xgrj-p7pg-6vm3 vulncheck.com: https://www.vulncheck.com/advisories/sveltekit-2.10.0-before-3.0.0-path-traversal-via-vite-preview-on-windows

Credits

🔍 GekkoQuest Rich-Harris