Vulnerability Description
A path traversal vulnerability exists in the built-in preview/development web server of Lektor <3.3.14 on Windows. An attacker with network access to the server can send a crafted HTTP request containing path traversal sequences to read arbitrary files accessible to the process, disclosing sensitive information such as system files and deployment configuration files containing credentials.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/TKar0/TKar0-CvePoc/tree/main/2026-CVE-POC/CVE-2026-75418
- https://github.com/lektor/lektor
- https://github.com/TKar0/TKar0-CvePoc/tree/main/2026-CVE-POC/CVE-2026-75418
FAQ
What is CVE-2026-75418?
CVE-2026-75418 is a vulnerability with a CVSS score of 7.5 (HIGH). A path traversal vulnerability exists in the built-in preview/development web server of Lektor <3.3.14 on Windows. An attacker with network access to the server can send a crafted HTTP request contain...
How severe is CVE-2026-75418?
CVE-2026-75418 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-75418?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.