CVE-2026-75418CWE-22path-traversal

CVE-2026-75418

High · published August 28, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
49.7
In the wild
Unconfirmed
What it is

A path traversal vulnerability exists in the built-in preview/development web server of Lektor <3.3.14 on Windows. An attacker with network access to the server can send a crafted HTTP request containing path traversal sequences to read arbitrary files accessible to the process, disclosing sensitive information such as system files and deployment configuration files containing credentials.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00634 · 49.7th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-08-28T04:18Z
References (3)
https://github.com/TKar0/TKar0-CvePoc/tree/main/2026-CVE-POC/CVE-2026-75418 · [email protected]https://github.com/lektor/lektor · [email protected]https://github.com/TKar0/TKar0-CvePoc/tree/main/2026-CVE-POC/CVE-2026-75418 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 02 SEP 03:39Z
    EPSS moved — → 0%
    epss
  • 27 AUG 00:00Z
    A path traversal vulnerability exists in the built-in preview/development web server of Lektor <3.3.14 on Windows
    cvelistv5