{"id":"CVE-2026-123619","published":"2026-11-06T15:17:19.363","lastModified":"2026-11-06T17:17:20.627","description":"Lektor through 3.3.14 and 3.4.0b15 contains an absolute path traversal vulnerability in the admin API on Windows that allows attackers to escape the project directory by supplying drive-letter paths that cleanup_path does not normalise. Attackers can use a malicious web page with cross-site requests or DNS rebinding against the unauthenticated local server to recursively delete directories via deleterecord or write attacker-controlled files via newattachment.","cvssScore":6.8,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H","cwes":["CWE-36"],"vendors":[],"products":[],"references":[{"url":"https://github.com/lektor/lektor","tags":[]},{"url":"https://github.com/lektor/lektor/blob/v3.3.14/lektor/db.py#L1334-L1336","tags":[]},{"url":"https://github.com/lektor/lektor/blob/v3.3.14/lektor/utils.py#L83-L94","tags":[]},{"url":"https://github.com/lektor/lektor/issues/1301","tags":[]},{"url":"https://github.com/lektor/lektor/pull/1288","tags":[]},{"url":"https://github.com/lektor/lektor/pull/1302","tags":[]},{"url":"https://www.vulncheck.com/advisories/lektor-through-3.3.14-and-3.4-0b15-path-traversal-via-admin-api-drive-letter-paths","tags":[]},{"url":"https://github.com/lektor/lektor/issues/1301","tags":[]}],"exploitRefs":[{"url":"https://github.com/lektor/lektor","tags":[]},{"url":"https://github.com/lektor/lektor/blob/v3.3.14/lektor/db.py#L1334-L1336","tags":[]},{"url":"https://github.com/lektor/lektor/blob/v3.3.14/lektor/utils.py#L83-L94","tags":[]},{"url":"https://github.com/lektor/lektor/issues/1301","tags":[]},{"url":"https://github.com/lektor/lektor/pull/1288","tags":[]},{"url":"https://github.com/lektor/lektor/pull/1302","tags":[]},{"url":"https://github.com/lektor/lektor/issues/1301","tags":[]}],"hasPoc":true,"ai":null}