{"action":"Upgrade lektor to 3.3.11 or later.","affected":[{"fixed":"3.3.11","introduced":"0"},{"fixed":"3.4.0b11","introduced":"3.4.0b1"}],"component":"lektor","cve_ids":["CVE-2024-28335"],"ecosystem":"PyPI","epss":0.00842,"exploited":false,"fixed_versions":["3.3.11","3.4.0b11"],"ghsa_id":"GHSA-wv28-7fpw-fj49","id":"tcs_01M5KG2VY5V5VQY7AMGXXF6E4Y","modified_at":"2024-08-06T19:00:46.448640Z","published_at":"2024-03-27T06:30:33Z","references":["https://osv.dev/vulnerability/GHSA-wv28-7fpw-fj49","https://nvd.nist.gov/vuln/detail/CVE-2024-28335","https://github.com/lektor/lektor/pull/1179/commits/8f38b9713d152622b69ff5e3b1e6a0d7bb7fa800","https://github.com/lektor/lektor/commit/7393d87bd354e43120937789956175064e4610a0","https://brave.com/privacy-updates/27-localhost-permission","https://cxsecurity.com/issue/WLB-2024030043","https://getlektor.com/docs/quickstart","https://github.com/lektor/lektor/releases/tag/v3.3.11","https://github.com/pypa/advisory-database/tree/main/vulns/lektor/PYSEC-2024-49.yaml","https://packetstormsecurity.com/files/177708/Lektor-Static-CMS-3.3.10-Arbitrary-File-Upload-Remote-Code-Execution.html"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-wv28-7fpw-fj49","url":"https://osv.dev/vulnerability/GHSA-wv28-7fpw-fj49"}],"summary":"Lektor does not sanitize database path traversal"}