CVE-2026-75418
Last modified
CVE-2026-75418 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. A path traversal vulnerability exists in the built-in preview/development web server of Lektor <3.3.14 on Windows. An attacker with network access to the server can send a crafted HTTP request containing path traversal sequences to read arbitrary files accessible to the process, disclosing sensitive information such as system files and deployment configuration files containing credentials.. EPSS estimates a 0.30% chance of exploitation in the next 30 days.
Description
A path traversal vulnerability exists in the built-in preview/development web server of Lektor <3.3.14 on Windows. An attacker with network access to the server can send a crafted HTTP request containing path traversal sequences to read arbitrary files accessible to the process, disclosing sensitive information such as system files and deployment configuration files containing credentials.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| — | — | n/a |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-75418?
How severe is CVE-2026-75418?
How do I fix CVE-2026-75418?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-7541A denial of service vulnerability was identified in GitHub E…7.5
- CVE-2026-75411JeecgBoot v3.9.2 is vulnerable to Remote command execution. …9.8
- CVE-2026-75413DocSys V2.02.80 is vulnerable to Any File Download. An attac…7.5
- CVE-2026-75414In AntFlow V2.0.0, ActivitiTest.java enables users to execut…9.8
- CVE-2026-75415AntFlow V2.0.0 is vulnerable to Incorrect Access Control. Ji…7.5
- CVE-2026-75417A SQL injection vulnerability was found in YzmCMS 7.5. The i…7.2
- CVE-2026-75419go-wind-cms (GoWind) before 1.0.0 has a missing authorizatio…8.8
- CVE-2026-7542The Slider Revolution plugin for WordPress is vulnerable to …6.5
- CVE-2026-75421aria2 <=1.37.0 has a stack-buffer-underflow vulnerability in…4
- CVE-2026-75429PowerJob versions 4.x through 5.1.2 contain an unauthenticat…
- CVE-2026-7543The Breakdance plugin for WordPress is vulnerable to Stored …7.2
- CVE-2026-75430PowerJob Worker version 5.1.2 (and likely earlier versions) …9.8
Are you affected by CVE-2026-75418?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST