CVE-2026-75418
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
A path traversal vulnerability exists in the built-in preview/development web server of Lektor <3.3.14 on Windows. An attacker with network access to the server can send a crafted HTTP request containing path traversal sequences to read arbitrary files accessible to the process, disclosing sensitive information such as system files and deployment configuration files containing credentials.
Risk Assessment
The risk includes disclosure of sensitive information, including credentials, which could lead to further attacks on the system.
Recommendation
It is recommended to upgrade Lektor to version 3.3.14 or later and restrict network access to the development server.
Original NVD description (English source)
A path traversal vulnerability exists in the built-in preview/development web server of Lektor <3.3.14 on Windows. An attacker with network access to the server can send a crafted HTTP request containing path traversal sequences to read arbitrary files accessible to the process, disclosing sensitive information such as system files and deployment configuration files containing credentials.