CVE-2026-123619: Lektor through 3.3.14 and 3.4.0b15 Path Traversal via Admin API Drive-Letter Paths
Lektor through 3.3.14 and 3.4.0b15 contains an absolute path traversal vulnerability in the admin API on Windows that allows attackers to escape the project directory by supplying drive-letter paths that cleanuppath does not normalise. Attackers can use a malicious web page with cross-site requests or DNS rebinding against the unauthenticated local server to recursively delete directories via deleterecord or write attacker-controlled files via newattachment.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue affects Lektor on Windows because the vulnerable path handling permits drive-letter paths to escape the project directory. The exposed component is the unauthenticated local admin server.
What does an attacker need to exploit it?
An attacker needs to cause requests to the local admin API, such as through a malicious web page making cross-site requests or through DNS rebinding. No authentication to the local server is required.
What could exploitation allow?
An attacker can use the deleterecord API action to recursively delete directories outside the project directory. They can also use newattachment to write attacker-controlled files outside that directory.