CVE-2026-123619

Lektor versions through 3.3.14 and 3.4.0b15 are vulnerable to an absolute path traversal vulnerability within the admin API on Windows. The root cause is that the cleanup_path function fails to normalize paths containing drive-letter paths , allowing attackers to escape the project directory. An ...