Path Traversal Vulnerability in Lektor Web Server on Windows
CVE-2026-75418

7.5HIGH

Key Information:

Vendor

Lektor

Status
Lektor
Vendor
CVE Published:
27 August 2026

What is CVE-2026-75418?

A path traversal vulnerability has been identified in the built-in preview and development web server of Lektor versions prior to 3.3.14 on Windows systems. This issue allows an attacker with network access to the server to exploit the vulnerability by sending a specially crafted HTTP request that includes path traversal sequences. Successful exploitation enables the attacker to read arbitrary files within the server's filesystem, which may expose sensitive information, including system files and deployment configuration files containing sensitive credentials.

References

https://github.com/lektor/lektor
https://github.com/TKar0/TKar0-CvePoc/tree/main/2026-CVE-...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.