---
id: "CVE-2026-123619"
page: "https://infrastack.ai/live/CVE-2026-123619"
kind: "vulnerability"
aliases: ["CVE-2026-123619"]
title: "Lektor: Windows admin API path traversal lets attackers delete or write files"
severity: "medium"
cvss: 6.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["lektor", "package", "python", "windows"]
not_affected_if: ["admin-server-not-running", "non-windows"]
published_at: "2026-11-06T15:17:19+00:00"
first_seen_at: "2026-11-06T15:42:44+00:00"
updated_at: "2026-11-06T15:44:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123619", "first_seen_at": "2026-11-06T15:42:44+00:00"}]
exploit_sources: []
---

# Lektor: Windows admin API path traversal lets attackers delete or write files

Link for people: https://infrastack.ai/live/CVE-2026-123619 (this .md is for agents)

Lektor's local admin API on Windows does not normalise drive-letter paths, so requests can escape the project directory. A malicious web page visited by a developer can use cross-site requests or DNS rebinding to recursively delete directories or write attacker-chosen files.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the Lektor version is `3.3.14` or earlier, or `3.4.0b15`, with `lektor --version`
- Check whether the local admin server is running on Windows while a project is open in the Lektor admin interface

## Timeline

- 2026-11-06T15:42:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123619

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/lektor-through-3.3.14-and-3.4-0b15-path-traversal-via-admin-api-drive-letter-paths

## From the sources

Lektor through 3.3.14 and 3.4.0b15 contains an absolute path traversal vulnerability in the admin API on Windows that allows attackers to escape the project directory by supplying drive-letter paths that cleanup_path does not normalise. Attackers can use a malicious web page with cross-site requests or DNS rebinding against the unauthenticated local server to recursively delete directories via deleterecord or write attacker-controlled files via newattachment.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_