CVE-2026-75418: Lektor Path Traversal Vulnerability

CVE-2026-75418 Overview

CVE-2026-75418 is a path traversal vulnerability [CWE-22] in the built-in preview and development web server of Lektor versions prior to 3.3.14 on Windows. An unauthenticated attacker with network access can send a crafted HTTP request containing traversal sequences to read arbitrary files accessible to the server process. Disclosed files can include Windows system files and deployment configuration files that store credentials. The flaw is limited to the development server on Windows hosts and does not require user interaction or privileges.

Critical Impact
Remote, unauthenticated attackers can read arbitrary files on Windows systems running the Lektor preview server, exposing credentials and sensitive configuration data.

Affected Products

Lektor static content management system versions prior to 3.3.14
Lektor built-in preview server on Windows
Lektor development server (lektor server) on Windows

Discovery Timeline

2026-08-28 - CVE-2026-75418 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-75418

Vulnerability Analysis

The vulnerability resides in the request handling of Lektor's built-in preview and development web server when running on Windows. The server fails to properly normalize and validate request paths before mapping them to files on disk. An attacker can supply traversal sequences in the URL to escape the intended web root and read files elsewhere on the filesystem.

The scope is confined to file disclosure. The CVSS vector indicates a network-reachable attack with no authentication or user interaction, and impact is limited to confidentiality. Integrity and availability of the host are not directly affected by this issue. The EPSS score is 0.406%, reflecting current exploitation likelihood estimates.

Because the preview server is intended for local development, deployments that expose it on non-loopback interfaces materially increase exposure. Sensitive targets include Windows system files, source code, .lektorproject deployment configuration, and credential material used by publishing plugins.

Root Cause

The root cause is insufficient sanitization of user-supplied path components in HTTP requests handled by the preview server. On Windows, path separators and encoded traversal sequences such as ..\ and ..%2f are not stripped or canonicalized before file resolution. The server then serves the resolved file if the process has read access.

Attack Vector

An attacker with network reachability to the Lektor preview server sends an HTTP GET request containing traversal sequences targeting a file outside the site root. The server resolves the path against the Windows filesystem and returns the file contents in the response. No credentials, tokens, or prior session state are required.

A verified proof-of-concept is published in the GitHub PoC for CVE-2026-75418 repository. The Lektor source is available in the GitHub Lektor Repository.

Detection Methods for CVE-2026-75418

Indicators of Compromise

HTTP requests to the Lektor preview server containing ..\, ../, or URL-encoded variants such as ..%5c and ..%2f in the path.
Access log entries requesting Windows system paths such as windows\win.ini, boot.ini, or absolute paths beginning with a drive letter.
Outbound responses from the preview server containing content from .lektorproject, .ini, or credential files not part of the site output.

Detection Strategies

Inspect web server and reverse proxy access logs for path traversal patterns targeting the Lektor preview port (default 5000).
Alert on any external source IP connecting to the Lektor development server, since it should be bound to localhost.
Correlate file read events on Windows hosts running lektor server with anomalous parent HTTP requests to identify successful disclosure.

Monitoring Recommendations

Monitor Windows endpoints for lektor.exe or Python processes serving Lektor bound to non-loopback interfaces.
Track network flows to development ports on developer workstations and build servers to detect unintended exposure.
Baseline HTTP responses from the preview server and alert when response bodies match sensitive file signatures.

How to Mitigate CVE-2026-75418

Immediate Actions Required

Upgrade Lektor to version 3.3.14 or later on all Windows hosts running the preview or development server.
Bind the Lektor preview server to 127.0.0.1 and block external access at the host firewall.
Rotate any credentials stored in Lektor project or deployment configuration files that were reachable from an exposed preview server.

Patch Information

Upgrade to Lektor 3.3.14 or later, which contains the fix for this path traversal issue. Refer to the GitHub Lektor Repository for release notes and source changes. The preview server should be treated as a development-only tool and never exposed to untrusted networks, even when patched.

Workarounds

Run the Lektor preview server only on localhost and use SSH tunneling for remote preview instead of exposing the port.
Restrict inbound access to the Lektor server port with a host-based firewall rule limited to trusted developer addresses.
Use the static build output (lektor build) served by a hardened web server rather than the development server for any shared or production environment.

bash

# Configuration example: bind preview server to loopback and upgrade Lektor
pip install --upgrade "lektor>=3.3.14"
lektor server --host 127.0.0.1 --port 5000