Description
Lektor through 3.3.14 and 3.4.0b15 contains an absolute path traversal vulnerability in the admin API on Windows that allows attackers to escape the project directory by supplying drive-letter paths that cleanup_path does not normalise. Attackers can use a malicious web page with cross-site requests or DNS rebinding against the unauthenticated local server to recursively delete directories via deleterecord or write attacker-controlled files via newattachment.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| lektor | lektor | ≤ 3.3.14, 3.4.0b1 – ≤ 3.4.0b15 | — |
References
- GitHub Issue #1301 issue-tracking
- https://github.com/lektor/lektor product
- Database.to_fs_path technical-description
- cleanup_path technical-description
- Proposed fix pull request #1302 issue-tracking patch
- Earlier incomplete fix pull request #1288 issue-tracking patch
- VulnCheck Advisory: Lektor through 3.3.14 and 3.4.0b15 Path Traversal via Admin API Drive-Letter Paths third-party-advisory