CVE-2026-75418: n/a

CVE-2026-75418 is a path traversal vulnerability in the built-in preview/development web server of Lektor on Windows platforms before version 3.3.14. An attacker with network access can exploit this by sending specially crafted HTTP requests with path traversal sequences to read arbitrary files accessible to the server process. This can lead to disclosure of sensitive information including system files and deployment configuration files that may contain credentials. The vulnerability has a CVSS v3.1 base score of 7.5 (High) with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Successful exploitation allows an unauthenticated remote attacker to read arbitrary files on the affected system running the vulnerable Lektor preview/development web server on Windows. This can lead to disclosure of sensitive information such as system files and deployment configuration files containing credentials, potentially compromising system confidentiality.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the built-in preview/development web server to trusted users only and avoid exposing it to untrusted networks.