{"id":"CVE-2026-104059","published":"2026-10-01T19:17:19.480","lastModified":"2026-10-02T18:47:49.947","description":"Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, or Host allowlisting. Attackers can exploit the newattachment, deleterecord, build, clean, and publish endpoints from a malicious web page to write arbitrary files, delete pages, wipe build output, trigger deployment publication, and via DNS rebinding reach read endpoints to disclose data.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","cwes":["CWE-352"],"vendors":[],"products":[],"references":[{"url":"https://gist.github.com/mansurmavlankulov/c7683e3204e84892e442b0196585d5bb","tags":[]},{"url":"https://www.vulncheck.com/advisories/lektor-csrf-via-admin-api-endpoints","tags":[]}],"exploitRefs":[{"url":"https://gist.github.com/mansurmavlankulov/c7683e3204e84892e442b0196585d5bb","tags":[]}],"hasPoc":true,"ai":{"summary":"Lektor 3.3.14 and 3.4.0b15 are vulnerable to cross-site request forgery, allowing unauthenticated attackers to perform state-changing actions via cross-origin requests without proper CSRF protection.","exploitability":"Exploitation is relatively easy as it requires sending cross-origin requests from a malicious web page, which can be automated with minimal effort.","blast_radius":"If exploited, attackers can write arbitrary files, delete pages, and trigger deployment publication, leading to significant data loss and system compromise.","remediation":"Upgrade to Lektor 3.3.15 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","csrf","web","api"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-06T08:45:25.245Z"}}