high · CVSS v3 7.5

CVE-2026-114063

SvelteKit versions 2.10.0 through 2.99.9 expose a path traversal flaw in the Vite preview server on Windows, letting unauthenticated users r

Overview

SvelteKit versions 2.10.0 through 2.99.9 expose a path traversal flaw in the Vite preview server on Windows, letting unauthenticated users read arbitrary files outside the prerendered output. The vulnerability can leak source code, configuration, or credentials if the preview server is reachable over the network. It is critical for deployments that expose the preview server to the internet or internal network.

Description

SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunnel can send crafted requests to expose source code, configuration, or credentials readable by the server process.

Impact

Confidentiality: attackers can read sensitive files, including source code, config, and credentials. Integrity: no direct modification, but exposure can lead to further attacks. Availability: not directly impacted. Defenders: web application teams, DevOps, and security ops who run SvelteKit preview servers.

Remediation

Upgrade to SvelteKit 3.0.0 or later. If upgrading is not immediately possible, disable the Vite preview server in production or restrict its network exposure using firewall rules or VPN. Ensure the preview server runs with least privilege and that file system permissions prevent reading sensitive files.

Risk context

Severity high (CVSS 7.5). No EPSS data available. The flaw allows unauthenticated file disclosure, making it a high-priority issue for any environment that exposes the preview server.

Affected products

  • SvelteKit 2.10.0
  • SvelteKit 2.11.0
  • SvelteKit 2.99.9

Scores

Severity
high
CVSS v2
7.8
CVSS v3
7.5
CVSS v4
—
EPSS
—

path-traversal file-disclosure SvelteKit preview-server Windows high-severity web-application

← All CVEs

Related CVEs

high

CVE-2026-114066

Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not own by supplying a foreign parentRunId to batch-creation endpoints. Attackers can send requests to POST /api/v3/batches or POST /api/v2/tasks/batch with resumeParentOnCompletion to suspend, indefinitely block, or inject errors into production or cross-organization runs.

View analysis

high

CVE-2026-114068

Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block runs belonging to other organizations. Attackers holding any secret API key can supply a victim run ID with their own waitpoint, causing that run to block indefinitely on a waitpoint the victim cannot complete, and can inject resume data into it.

View analysis

high

CVE-2026-114069

Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the environment's root API key as TRIGGER_SECRET_KEY for staging, production, and preview environments. Attackers holding a restricted read:envvars key can obtain the root secret and plaintext secrets, then trigger tasks and mint admin public JWTs.

View analysis

high

CVE-2026-114077

Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeployment by friendlyId alone, without environment, project, or organization scoping. Attackers holding only their own environment API key can POST to the deployment background-workers endpoint with a victim's deployment ID to re-point that in-progress deployment at a worker in the attacker's environment.

View analysis