CVE-2026-123619mediumCWE-36

CVE-2026-123619: medium-severity vulnerability in lektor

Lektor through 3.3.14 and 3.4.0b15 Path Traversal via Admin API Drive-Letter Paths

Published

Follow this CVE+ Monitor lektor

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

10Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.9
Lektor through 3.3.14 and 3.4.0b15 contains an absolute path traversal vulnerability in the admin API on Windows that allows attackers to escape the project directory by supplying drive-letter paths that cleanup_path does not normalise. Attackers can use a malicious web page with cross-site requests or DNS rebinding against the unauthenticated local server to recursively delete directories via deleterecord or write attacker-controlled files via newattachment.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
lektor · lektor
Related CVEs — lektor

In the same product, most dangerous first.

CVE-2026-104059HIGHLektor 3.3.14 CSRF via Admin API EndpointsEPSS 0.1%