CVE-2026-40611 Details

A path traversal vulnerability has been identified in the webroot HTTP-01 challenge provider of the Let's Encrypt client and ACME library written in Go, known as Lego. This vulnerability, present in all versions prior to 4.34.0, allows a malicious ACME server to craft challenge tokens with '../' sequences. When these tokens are processed, Lego can be tricked into writing or deleting files at arbitrary locations accessible by the Lego process. The issue arises because the challenge file path is constructed by directly concatenating the ACME token without proper validation, enabling tokens to traverse directories and manipulate files outside the intended webroot.

Users should update to Lego version 4.34.0 or later, where this vulnerability has been fixed.