CVE-2026-123619

Lektor through 3.3.14 and 3.4.0b15 contains an absolute path traversal vulnerability in the admin API on Windows that allows attackers to escape the project directory by supplying drive-letter paths that cleanuppath does not normalise. Attackers can use a malicious web page with cross-site reques...