Path Traversal Vulnerability in Lektor Admin API on Windows
CVE-2026-123619

5.9MEDIUM

Key Information:

Vendor

Lektor

Status
Lektor
Vendor
CVE Published:
6 November 2026

What is CVE-2026-123619?

Lektor versions 3.3.14 and 3.4.0b15 are susceptible to an absolute path traversal vulnerability in the admin API on Windows. This issue allows attackers to bypass the project directory by supplying drive-letter paths that are not normalized by the cleanup_path function. Exploiting this vulnerability can enable attackers to recursively delete directories through the deleterecord function or to upload files controlled by the attacker via newattachment. This poses significant risks to the integrity and confidentiality of data hosted on affected Lektor installations.

Affected Version(s)

lektor 0 <= 3.3.14

lektor 3.4.0b1 <= 3.4.0b15

References

https://github.com/lektor/lektor/issues/1301
issue-tracking
https://github.com/lektor/lektor
product
https://github.com/lektor/lektor/blob/v3.3.14/lektor/db.p...
technical-description

CVSS V4

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

MD Mahmidul Hasan (BL4CK_570RM)
Abdullah Al Sabit
.