---
id: CVE-2026-114063
title: SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows
summary: >-
  SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal
  vulnerability in the vite preview server on Windows that allows
  unauthenticated attackers to read files outside the prerendered output
  directory. Attackers who …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-22
vendor: sveltejs
product: kit
affected:
  - kit >= 2.10.0 < 3.0.0
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T00:36:36.847Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114063'
references:
  - url: 'https://github.com/sveltejs/kit/security/advisories/GHSA-xgrj-p7pg-6vm3'
    label: GitHub Security Advisory (GHSA-xgrj-p7pg-6vm3)
  - url: >-
      https://www.vulncheck.com/advisories/sveltekit-2.10.0-before-3.0.0-path-traversal-via-vite-preview-on-windows
    label: >-
      VulnCheck Advisory: SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite
      preview on Windows
tags:
  - cve.org
ingestedAt: '2026-10-21T01:37:08.038Z'
---

## Overview

SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunnel can send crafted requests to expose source code, configuration, or credentials readable by the server process.

## Affected

- `kit >= 2.10.0 < 3.0.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.