---
id: CVE-2026-123619
title: >-
  Lektor through 3.3.14 and 3.4.0b15 Path Traversal via Admin API Drive-Letter
  Paths
summary: >-
  Lektor through 3.3.14 and 3.4.0b15 contains an absolute path traversal
  vulnerability in the admin API on Windows that allows attackers to escape the
  project directory by supplying drive-letter paths that cleanup_path does not
  normalise. …
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-36
vendor: lektor
product: lektor
affected:
  - lektor <= 3.3.14
  - lektor >= 3.4.0b1 <= 3.4.0b15
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T17:07:44.333808Z'
exploitAvailable: true
published: '2026-11-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T17:07:51.308Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-123619'
references:
  - url: 'https://github.com/lektor/lektor/issues/1301'
    label: 'GitHub Issue #1301'
  - url: 'https://github.com/lektor/lektor'
  - url: 'https://github.com/lektor/lektor/blob/v3.3.14/lektor/db.py#L1334-L1336'
    label: Database.to_fs_path
  - url: 'https://github.com/lektor/lektor/blob/v3.3.14/lektor/utils.py#L83-L94'
    label: cleanup_path
  - url: 'https://github.com/lektor/lektor/pull/1302'
    label: 'Proposed fix pull request #1302'
  - url: 'https://github.com/lektor/lektor/pull/1288'
    label: 'Earlier incomplete fix pull request #1288'
  - url: >-
      https://www.vulncheck.com/advisories/lektor-through-3.3.14-and-3.4-0b15-path-traversal-via-admin-api-drive-letter-paths
    label: >-
      VulnCheck Advisory: Lektor through 3.3.14 and 3.4.0b15 Path Traversal via
      Admin API Drive-Letter Paths
tags:
  - cve.org
  - exploit-available
ingestedAt: '2026-11-06T15:54:04.080Z'
epss: 0.00467
epssPercentile: 0.40699
---

## Overview

Lektor through 3.3.14 and 3.4.0b15 contains an absolute path traversal vulnerability in the admin API on Windows that allows attackers to escape the project directory by supplying drive-letter paths that cleanup_path does not normalise. Attackers can use a malicious web page with cross-site requests or DNS rebinding against the unauthenticated local server to recursively delete directories via deleterecord or write attacker-controlled files via newattachment.

## Affected

- `lektor <= 3.3.14`
- `lektor >= 3.4.0b1 <= 3.4.0b15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.