CVE-2026-75418
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
A path traversal vulnerability exists in the built-in preview/development web server of Lektor <3.3.14 on Windows. An attacker with network access to the server can send a crafted HTTP request containing path traversal sequences to read arbitrary files accessible to the process, disclosing sensitive information such as system files and deployment configuration files containing credentials.
Risk Assessment
The risk includes disclosure of sensitive information, including credentials, which could lead to further attacks on the system.
Recommendation
It is recommended to upgrade Lektor to version 3.3.14 or later and restrict network access to the development server.
Other vulnerabilities in Lektor
Original NVD description (English source)
A path traversal vulnerability exists in the built-in preview/development web server of Lektor <3.3.14 on Windows. An attacker with network access to the server can send a crafted HTTP request containing path traversal sequences to read arbitrary files accessible to the process, disclosing sensitive information such as system files and deployment configuration files containing credentials.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS