CVE-2026-104059

HighCVSS 8.1

Published: 01/10/2026(UTC)Updated: 02/10/2026(UTC)Translated: 02/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

3th percentile - higher than 3% of all known CVEs

Summary

Lektor 3.3.14 and 3.4.0b15 contains a CSRF vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions such as writing files, deleting pages, wiping build output, and triggering publication, by sending requests from malicious web pages.

Risk Assessment

An attacker can modify site content, delete data, and publish changes, potentially leading to full control of the service.

Recommendation

Upgrade Lektor to a version with the CSRF fix, or apply protections such as CSRF tokens.

Other vulnerabilities in Lektor

CVE-2026-75418High
A path traversal vulnerability exists in the built-in preview/development web server of Lektor <3.3.14 on Windows. An attacker with network access to the server can send a crafted HTTP request containing path traversal sequences to read arbitrary files accessible to the process, disclosing sensitive information such as system files and deployment configuration files containing credentials.

Original NVD description (English source)

Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, or Host allowlisting. Attackers can exploit the newattachment, deleterecord, build, clean, and publish endpoints from a malicious web page to write arbitrary files, delete pages, wipe build output, trigger deployment publication, and via DNS rebinding reach read endpoints to disclose data.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS