Lektor vulnerabilities
We track 2 vulnerabilities in Lektor products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 1, 2026.
2vulnerabilities
1critical
1high
0exploited
8.6average CVSS score
Latest Lektor vulnerabilities
- 8.1 High severity
lektor: Cross-Site Request Forgery
Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, C
- 9.1 Critical severity
lektor: Improper Limitation of a Pathname to a Restricted Directory
Lektor before 3.3.11 does not sanitize DB path traversal. Thus, shell commands might be executed via a file that is added to the templates directory, if the victim's web browser accesses an untrusted website that uses JavaScript to send requests to localhost p