CVE-2026-75418: n/a

CVE-2026-75418 is a path traversal vulnerability affecting the built-in preview/development web server of Lektor on Windows platforms before version 3.3.14. An attacker with network access can exploit this vulnerability by sending specially crafted HTTP requests that include path traversal sequences, enabling them to read arbitrary files accessible to the server process. This can lead to disclosure of sensitive information including system files and deployment configuration files that may contain credentials. The vulnerability has a CVSS v3.1 base score of 7.5, indicating high severity, with no required privileges or user interaction for exploitation. No official patch or remediation guidance is currently provided in the available data.

Successful exploitation allows an unauthenticated attacker with network access to the vulnerable Lektor development server on Windows to read arbitrary files. This can result in disclosure of sensitive system and configuration files, potentially exposing credentials and other confidential information. The vulnerability does not allow modification or denial of service but compromises confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the built-in preview/development web server of Lektor on Windows to trusted users only, and avoid exposing it to untrusted networks.