CVE-2026-114063 SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows

High 8.7 Published 21 Oct 2026 Updated 27 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-114063?

CVE-2026-114063 is a high-severity vulnerability in sveltejs kit, published on 21 Oct 2026.

Official description

SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunnel can send crafted requests to expose source code, configuration, or credentials readable by the server process.

Weakness: CWE-22

Which versions are affected by CVE-2026-114063?

How do I fix CVE-2026-114063?

No fix has been published for CVE-2026-114063 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-114063 being exploited?

There is no known exploitation of CVE-2026-114063 in the wild and no public exploit code.

Sources

Also known as GHSA-92p4-8jf4-qc63, GHSA-xgrj-p7pg-6vm3.