Executive brief
Lektor is a static website generator with a built-in preview/development web server. A path traversal vulnerability in versions before 3.3.14 on Windows allows an attacker to read arbitrary files from the server, potentially exposing sensitive configuration files, credentials, and system files to unauthorized access.
Technical details
A path traversal vulnerability exists in Lektor's built-in preview/development web server that fails to properly sanitize HTTP request paths containing traversal sequences (such as ../ or ..\). An attacker with network access can craft HTTP requests to bypass path restrictions and read files outside the intended directory. The vulnerability is specific to Windows systems in versions before 3.3.14. Exploitation requires only network access to the preview server; no authentication is needed. An attacker can disclose arbitrary files accessible to the Lektor process, including deployment configurations and credentials. A patch is available in Lektor 3.3.14 and later.
Affected products
- Lektor Lektor <3.3.14
Timeline
- 2026-08-28: disclosed
- other: Proof-of-concept available on GitHub