CVE-2026-123619 · Package
NO FIX YET
Lektor's local admin API on Windows does not normalise drive-letter paths, so requests can escape the project directory. A malicious web page visited by a developer can use cross-site requests or DNS rebinding to recursively delete directories or write attacker-chosen files.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Affects developers running the Lektor static site generator's local admin server on Windows. The admin API is unauthenticated, so exposure comes from a developer browsing a malicious page while the server runs. Systems not running Lektor's admin server on Windows are not affected.
Not affected if admin-server-not-running, non-windows
Who cares lektor, python, windows
3.3.14 or earlier, or 3.4.0b15, with lektor --versionNo fix yet, per the sources.
Lektor through 3.3.14 and 3.4.0b15 contains an absolute path traversal vulnerability in the admin API on Windows that allows attackers to escape the project directory by supplying drive-letter paths that cleanup_path does not normalise. Attackers can use a malicious web page with cross-site requests or DNS rebinding against the unauthenticated local server to recursively delete directories via deleterecord or write attacker-controlled files via newattachment.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.