CVE-2026-123619— Lektor through 3.3.14 and 3.4.0b15 Path Traversal via Admin API Drive-Letter Paths

Quick assessment

Affected

lektor lektor

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Lektor 3.3.14 及 3.4.0b15 版本在 Windows 环境下的管理 API 中存在绝对路径遍历漏洞。攻击者可通过提供包含盘符的路径（此类路径无法被函数正确规范化），从而突破项目目录限制。攻击者可利用恶意网页发起跨站请求（XSRF）或 DNS 重绑定攻击，针对未认证的本地服务器，通过接口递归删除目录，或通过接口写入攻击者可控的文件。

CVSS 6.8 · Medium EPSS 0.47% · P41 Updated Nov 07, 2026

Possible ATT&CK Techniques 2 AI

T1574 · Hijack Execution Flow T1190 · Exploit Public-Facing Application

Affected Version Matrix 2

Vendor	Product	Version Range	Status
lektor	lektor	`≤ 3.3.14`	affected
		`3.4.0b1≤ 3.4.0b15`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Lektor through 3.3.14 and 3.4.0b15 Path Traversal via Admin API Drive-Letter Paths

Source: CVE Program / CVE List V5

Vulnerability Description

Lektor through 3.3.14 and 3.4.0b15 contains an absolute path traversal vulnerability in the admin API on Windows that allows attackers to escape the project directory by supplying drive-letter paths that cleanup_path does not normalise. Attackers can use a malicious web page with cross-site requests or DNS rebinding against the unauthenticated local server to recursively delete directories via deleterecord or write attacker-controlled files via newattachment.

Source: CVE Program / CVE List V5