Path Traversal Vulnerability in SvelteKit on Windows

CVE-2026-114063

What is CVE-2026-114063?

The SvelteKit framework, versions 2.10.0 to 2.10.2, is prone to a path traversal vulnerability within the vite preview server on Windows. This flaw permits unauthenticated attackers to access sensitive files located outside the intended prerendered output directory. With network access to the preview server, attackers can manipulate requests to read source code, configuration files, or sensitive credentials that the server process can access, posing significant risks to the integrity and confidentiality of affected applications.

References