Lektor
Monthly
Cross-site request forgery in the Lektor admin API lets unauthenticated remote attackers perform state-changing actions - writing arbitrary files via newattachment, deleting pages via deleterecord, wiping build output via clean/build, and triggering deployment via publish - when an operator visits a malicious web page while the admin server is running. The flaw affects Lektor 3.3.14 and 3.4.0b15 and stems from the complete absence of CSRF tokens, Origin/Referer validation, CORS configuration, or Host allowlisting; read endpoints can additionally be reached via DNS rebinding to disclose data. No public exploit code or confirmed active exploitation was identified at time of analysis.
Cross-site request forgery in the Lektor admin API lets unauthenticated remote attackers perform state-changing actions - writing arbitrary files via newattachment, deleting pages via deleterecord, wiping build output via clean/build, and triggering deployment via publish - when an operator visits a malicious web page while the admin server is running. The flaw affects Lektor 3.3.14 and 3.4.0b15 and stems from the complete absence of CSRF tokens, Origin/Referer validation, CORS configuration, or Host allowlisting; read endpoints can additionally be reached via DNS rebinding to disclose data. No public exploit code or confirmed active exploitation was identified at time of analysis.