CVE-2024-28335

Lektor before 3.3.11 does not sanitize DB path traversal. Thus, shell commands might be executed via a file that is added to the templates directory, if the victim's web browser accesses an untrusted website that uses JavaScript to send requests to localhost port 5000, and the web browser is...

UBUNTU-CVE-2024-28335

Lektor before 3.3.11 does not sanitize DB path traversal. Thus, shell commands might be executed via a file that is added to the templates directory, if the victim's web browser accesses an untrusted website that uses JavaScript to send requests to localhost port 5000, and the web browser is...

CVE-2024-28335

Lektor versions prior to 3.3.11 are vulnerable to a Path Traversal vulnerability (CWE-22) due to improper sanitization of database path traversal inputs. An attacker can exploit this by tricking a victim's web browser into accessing an untrusted website that uses JavaScript to send requests to lo...