{"action":"Upgrade lektor to 3.3.11 or later.","affected":[{"fixed":"3.3.11","introduced":"0"}],"component":"lektor","cve_ids":["CVE-2024-28335"],"ecosystem":"PyPI","epss":0.00842,"exploited":false,"fixed_versions":["3.3.11"],"ghsa_id":"GHSA-wv28-7fpw-fj49","id":"tcs_01M5KGN8YBG5GFM1XNVQFYKHPQ","modified_at":"2026-06-10T17:02:00.064303339Z","published_at":"2024-03-27T06:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2024-49","https://github.com/lektor/lektor/pull/1179/commits/8f38b9713d152622b69ff5e3b1e6a0d7bb7fa800","https://github.com/lektor/lektor/releases/tag/v3.3.11","https://cxsecurity.com/issue/WLB-2024030043","https://packetstormsecurity.com/files/177708/Lektor-Static-CMS-3.3.10-Arbitrary-File-Upload-Remote-Code-Execution.html","https://getlektor.com/docs/quickstart","https://brave.com/privacy-updates/27-localhost-permission/","https://github.com/advisories/GHSA-wv28-7fpw-fj49"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2024-49","url":"https://osv.dev/vulnerability/PYSEC-2024-49"}],"summary":"Lektor before 3.3.11 does not sanitize DB path traversal. Thus, shell commands might be executed via a file that is added to the templates directory, if the victim's web browser accesses an untrusted"}