CVE-2026-114063: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in sveltejs kit

CVE-2026-114063 describes a path traversal vulnerability in SvelteKit's vite preview server on Windows platforms. Versions >=2.10.0 and <3.0.0 are affected. The vulnerability allows unauthenticated remote attackers to craft requests that bypass directory restrictions and read arbitrary files outside the prerendered output directory. This can lead to disclosure of sensitive information including source code and credentials. The vulnerability has a CVSS 4.0 score of 8.7, indicating high severity. No known exploits in the wild have been reported. No patch or vendor advisory information is provided in the input data.

An attacker who can reach the vite preview server on Windows can read arbitrary files outside the intended directory without authentication. This can lead to exposure of sensitive data such as source code, configuration files, or credentials accessible by the server process, potentially compromising the security of the affected system or application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the vite preview server, especially on Windows, to trusted users only. Avoid exposing the preview server to untrusted networks or tunnels.