CVE-2026-123619
MEDIUM
MEDIUM
Priority: 0.03
BB Relevance:
62/100
Published: 2026-11-06
Modified: 2026-11-12
First seen: 2026-11-06
Status: active
Attack Surface
Network
Low Complexity
No Auth
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
Active
S:
X
AT:
Present
VC:
None
VI:
High
VA:
High
Description
Lektor through 3.3.14 and 3.4.0b15 contains an absolute path traversal vulnerability in the admin API on Windows that allows attackers to escape the project directory by supplying drive-letter paths that cleanup_path does not normalise. Attackers can use a malicious web page with cross-site requests or DNS rebinding against the unauthenticated local server to recursively delete directories via deleterecord or write attacker-controlled files via newattachment.