CVE-2026-75418: Path Traversal
A path traversal vulnerability exists in the built-in preview/development web server of Lektor <3.3.14 on Windows. An attacker with network access to the server can send a crafted HTTP request containing path traversal sequences to read arbitrary files accessible to the process, disclosing sensitive information such as system files and deployment configuration files containing credentials.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Lektor versions earlier than 3.3.14 are affected when their built-in preview/development web server is running on Windows and is reachable over the network.
What does an attacker need to exploit this issue?
An attacker needs network access to the built-in server and can exploit the issue without authentication or user interaction by sending a crafted HTTP request with path traversal sequences.
What could an attacker access?
The attacker can read arbitrary files that are accessible to the Lektor server process. This may include system files and deployment configuration files containing credentials.