CVE-2024-28335

What it actually does

Path traversal in DB path handling permits unsanitized input to write attacker-controlled files into the templates directory, resulting in arbitrary shell command execution when those templates are processed by the running lektor server.

Why it matters to the business

Developers and teams using Lektor locally face risk of remote code execution on their workstations when browsing untrusted sites, potentially leading to credential theft or further compromise; low ecosystem prevalence and stable low EPSS reduce immediate widespread urgency but patching remains essential for any users of the affected versions.

How an attack unfolds

An attacker prepares a malicious website containing JavaScript that issues requests to localhost:5000. A victim running 'lektor server' visits the site in the same browser session; the requests exploit the unsanitized DB path to place a malicious file in the templates directory, after which template access triggers shell command execution on the victim's machine.

How to fix it

Upgrade lektor/lektor to the version containing commit 495b3f48feb1c1d9f43a7059473a55b404a1435a (corresponding to release 3.3.11). Verify the fix is present before resuming local server use.

How to confirm the fix worked

Confirm the running Lektor version is 3.3.11 or newer, or inspect the source for presence of commit 495b3f48feb1c1d9f43a7059473a55b404a1435a. Reproduce path traversal attempts in a test environment to verify sanitization now blocks template injection.

Typical attack path

1. Victim starts lektor server listening on localhost port 5000
2. Victim's browser visits attacker-controlled website
3. Website JavaScript issues crafted requests exploiting path traversal
4. Malicious file is written into the templates directory
5. Template processing executes attacker-supplied shell commands

How to detect it

Review Lektor access and error logs for unexpected path traversal patterns or template writes originating from localhost requests. Examine the templates directory for recently added or modified files lacking legitimate provenance.

What your security team should do

• Apply the fixed commit or upgrade to 3.3.11 across all Lektor installations immediately
• Instruct developers to avoid running the lektor server while accessing untrusted websites
• Add Lektor version checks to dependency scanning and build pipelines
• Review any custom templates or DB path handling for similar unsanitized inputs