Log in Start free

Vulnerability · Published Mar 27, 2024 · Assigned by mitre

CVE-2024-28335

Critical 9.1

In plain English

A critical-severity path traversal in the lektor package (PyPI). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)0.8%top 41.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Lektor before 3.3.11 does not sanitize DB path traversal. Thus, shell commands might be executed via a file that is added to the templates directory, if the victim's web browser accesses an untrusted website that uses JavaScript to send requests to localhost port 5000, and the web browser is running on the same machine as the "lektor server" command.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIlektor3.3.11GHSA-wv28-7fpw-fj49
PyPIlektor3.4.0b11GHSA-wv28-7fpw-fj49
PyPIlektor3.3.11PYSEC-2024-49
Ubuntu:22.04:LTSlektorno fix listedUBUNTU-CVE-2024-28335
Ubuntu:24.04:LTSlektorno fix listedUBUNTU-CVE-2024-28335
Ubuntu:25.10lektorno fix listedUBUNTU-CVE-2024-28335

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References