CVE-2026-123619
Lektor through 3.3.14 and 3.4.0b15 Path Traversal via Admin API Drive-Letter Paths
CVSS Score
6.8
EPSS Score
0.0%
EPSS Percentile
0th
Lektor through 3.3.14 and 3.4.0b15 contains an absolute path traversal vulnerability in the admin API on Windows that allows attackers to escape the project directory by supplying drive-letter paths that cleanup_path does not normalise. Attackers can use a malicious web page with cross-site requests or DNS rebinding against the unauthenticated local server to recursively delete directories via deleterecord or write attacker-controlled files via newattachment.
| CWE | CWE-36 |
| Vendor | lektor |
| Product | lektor |
| Published | Nov 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for lektor lektor
Be the first to know when new medium vulnerabilities affecting lektor lektor are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High
Affected Versions
lektor / lektor
0 ≤ 3.3.14 3.4.0b1 ≤ 3.4.0b15
References
github.com: https://github.com/lektor/lektor/issues/1301 github.com: https://github.com/lektor/lektor github.com: https://github.com/lektor/lektor/blob/v3.3.14/lektor/db.py#L1334-L1336 github.com: https://github.com/lektor/lektor/blob/v3.3.14/lektor/utils.py#L83-L94 github.com: https://github.com/lektor/lektor/pull/1302 github.com: https://github.com/lektor/lektor/pull/1288 vulncheck.com: https://www.vulncheck.com/advisories/lektor-through-3.3.14-and-3.4-0b15-path-traversal-via-admin-api-drive-letter-paths
Credits
MD Mahmidul Hasan (BL4CK_570RM) Abdullah Al Sabit