CVE-2026-123619
Lektor through 3.3.14 and 3.4.0b15 contains an absolute path traversal vulnerability in the admin…
- Risk score
- 41/100
- CVSS
- 6.8 v3.1
- Published
- 6 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Lektor through 3.3.14 and 3.4.0b15 contains an absolute path traversal vulnerability in the admin API on Windows that allows attackers to escape the project directory by supplying drive-letter paths that cleanup_path does not normalise. Attackers can use a malicious web page with cross-site requests or DNS rebinding a…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.8 medium
References
- https://github.com/lektor/lektor
- https://github.com/lektor/lektor/blob/v3.3.14/lektor/db.py#L1334-L1336
- https://github.com/lektor/lektor/blob/v3.3.14/lektor/utils.py#L83-L94
- https://github.com/lektor/lektor/issues/1301
- https://github.com/lektor/lektor/pull/1288
- https://github.com/lektor/lektor/pull/1302
- https://www.vulncheck.com/advisories/lektor-through-3.3.14-and-3.4-0b15-path-traversal-via-admin-api-drive-letter-paths
Original description
Lektor through 3.3.14 and 3.4.0b15 contains an absolute path traversal vulnerability in the admin API on Windows that allows attackers to escape the project directory by supplying drive-letter paths that cleanup_path does not normalise. Attackers can use a malicious web page with cross-site requests or DNS rebinding against the unauthenticated local server to recursively delete directories via deleterecord or write attacker-controlled files via newattachment.
Last activity 6 Nov 2026. Patch Forecast updates every hour.