{"id":"CVE-2026-114063","kind":"vulnerability","aliases":["CVE-2026-114063"],"related":[],"title":"SvelteKit on Windows: preview server path traversal exposes server files","description":"SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunnel can send crafted requests to expose source code, configuration, or credentials readable by the server process.","summary":"SvelteKit's vite preview server on Windows fails to block path traversal, so anyone who can reach it can read files outside the prerendered output directory. Readable source code, configuration, or credentials on the server can be exposed without logging in.","severity":"high","cvss":8.7,"epss":0.00405,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","sveltekit","vite","windows"],"not_affected_if":["linux-or-macos-only","no-preview-server-exposed","static-hosting"],"how_to_check":"Run 'npm ls @sveltejs/kit' to find versions 2.10.0 through 2.x; check whether 'vite preview' runs on a Windows host reachable from a network or tunnel.","fix":"Upgrade @sveltejs/kit to 3.0.0 or later; do not expose 'vite preview' to networks, and rotate any secrets the preview process could read if it was reachable.","status":"open","published_at":"2026-10-21T01:17:29+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-23T22:37:00+00:00","updated_at":"2026-10-24T13:15:55+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T22:37:00Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade @sveltejs/kit to 3.0.0 or later; do not expose 'vite preview' to networks, and rotate any secrets the preview process could read if it was reachable.","reach":"network","title":"SvelteKit on Windows: preview server path traversal exposes server files","impact":"high","summary":"SvelteKit's vite preview server on Windows fails to block path traversal, so anyone who can reach it can read files outside the prerendered output directory. Readable source code, configuration, or credentials on the server can be exposed without logging in.","category":"package","who_cares":["sveltekit","windows","vite"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads server source, config, or credentials over the network","analyst_note":"Confirm the exact affected version range and fixed version from the NVD entry; sources only give 'before 3.0.0' and CVSS 8.7.","how_to_check":"Run 'npm ls @sveltejs/kit' to find versions 2.10.0 through 2.x; check whether 'vite preview' runs on a Windows host reachable from a network or tunnel.","needs_analyst":true,"not_affected_if":["linux-or-macos-only","no-preview-server-exposed","static-hosting"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000529,"input_tokens":2956,"output_tokens":466,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114063':13A,16A '-2026':12A,15A '2.10.0':64C '3.0.0':66C 'access':100C 'allow':80C 'anyon':34B 'attack':82C,91C 'block':30B 'code':49B,111C 'configur':50B,112C 'contain':67C 'craft':106C 'credenti':52B,114C 'cve':11A,14A 'directori':46B,90C 'expos':8A,58B,109C 'fail':28B 'file':10A,41B,85C 'log':60B 'network':99C 'output':45B,89C 'outsid':42B,86C 'packag':17B 'path':6A,31B,69C 'prerend':44B,88C 'preview':4A,24B,75C,96C 'process':119C 'reach':37B,94C 'read':40B,84C 'readabl':47B,115C 'request':107C 'send':105C 'server':5A,9A,25B,55B,76C,97C,118C 'sourc':48B,110C 'sveltejs/kit':62C 'sveltekit':1A,18B,21B,61C 'travers':7A,32B,70C 'tunnel':103C 'unauthent':81C 'vite':19B,23B,74C 'vulner':71C 'window':3A,20B,27B,78C 'without':59B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T01:17:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114063","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114063","severity":null,"published_at":"2026-10-21T01:17:29+00:00","modified_at":"2026-10-22T17:34:37+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114063","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114063","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}