Description
A path traversal vulnerability exists in the built-in preview/development web server of Lektor <3.3.14 on Windows. An attacker with network access to the server can send a crafted HTTP request containing path traversal sequences to read arbitrary files accessible to the process, disclosing sensitive information such as system files and deployment configuration files containing credentials.
Published: 2026-08-27
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A path traversal flaw exists in the built‑in preview and development web server of Lektor versions earlier than 3.3.14 running on Windows. By sending a specially crafted HTTP request that contains directory traversal sequences, an attacker with network reachability to the server can read any file the server process can access. This can expose sensitive data such as system configuration files and credential files, compromising confidentiality and potentially allowing further exploitation.

Affected Systems

The vulnerability affects any installation of Lektor running its preview server on Windows where the version is less than 3.3.14. The preview/development server is intended for local testing and not designed for exposed network use.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity flaw. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog. An attacker only needs network connectivity to the preview server to send a crafted HTTP request; no additional authentication or privilege is required. The attack can be automated through scripts that iterate over common file paths to harvest sensitive information.

Generated by OpenCVE AI on August 28, 2026 at 07:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to Lektor version 3.3.14 or later.
  • If upgrading is not immediately possible, bind the preview server to localhost or block external access with a firewall.
  • Avoid running the preview server in production or on publicly reachable hosts.
  • Run the preview server with the least privileges necessary and enforce strict file permissions to protect sensitive data.

Generated by OpenCVE AI on August 28, 2026 at 07:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 08:15:00 +0000

Type Values Removed Values Added
Title Path Traversal in Lektor Preview Server Allows File Disclosure
Weaknesses CWE-22

Thu, 27 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Description A path traversal vulnerability exists in the built-in preview/development web server of Lektor <3.3.14 on Windows. An attacker with network access to the server can send a crafted HTTP request containing path traversal sequences to read arbitrary files accessible to the process, disclosing sensitive information such as system files and deployment configuration files containing credentials.
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:N/S:U/UI:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-08-27T21:17:31.574Z

Reserved: 2026-08-17T00:00:00.000Z

Link: CVE-2026-75418

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-28T00:18:12.530

Modified: 2026-08-28T00:18:12.530

Link: CVE-2026-75418

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T08:00:13Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')