Critical severity9.1OSV Advisory· Published Mar 27, 2024· Updated Apr 15, 2026
CVE-2024-28335
CVE-2024-28335
Description
Lektor before 3.3.11 does not sanitize DB path traversal. Thus, shell commands might be executed via a file that is added to the templates directory, if the victim's web browser accesses an untrusted website that uses JavaScript to send requests to localhost port 5000, and the web browser is running on the same machine as the "lektor server" command.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
LektorPyPI | < 3.3.11 | 3.3.11 |
LektorPyPI | >= 3.4.0b1, < 3.4.0b11 | 3.4.0b11 |
Affected products
2Patches
Vulnerability mechanics
References
11- github.com/advisories/GHSA-wv28-7fpw-fj49ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-28335ghsaADVISORY
- brave.com/privacy-updates/27-localhost-permissionghsaWEB
- cxsecurity.com/issue/WLB-2024030043nvdWEB
- getlektor.com/docs/quickstartnvdWEB
- github.com/lektor/lektor/commit/7393d87bd354e43120937789956175064e4610a0ghsaWEB
- github.com/lektor/lektor/pull/1179/commits/8f38b9713d152622b69ff5e3b1e6a0d7bb7fa800nvdWEB
- github.com/lektor/lektor/releases/tag/v3.3.11nvdWEB
- github.com/pypa/advisory-database/tree/main/vulns/lektor/PYSEC-2024-49.yamlghsaWEB
- packetstormsecurity.com/files/177708/Lektor-Static-CMS-3.3.10-Arbitrary-File-Upload-Remote-Code-Execution.htmlnvdWEB
- brave.com/privacy-updates/27-localhost-permission/nvd
News mentions
0No linked articles in our index yet.