Security Advisory

CVE-2026-40611

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2026-04-21 17:58:35

Last updated 2026-04-21 19:17:54

Assigner GitHub_M

State PUBLISHED

Description

Lets Encrypt client and ACME library written in Go (Lego). Prior to 4.34.0, the webroot HTTP-01 challenge provider in lego is vulnerable to arbitrary file write and deletion via path traversal. A malicious ACME server can supply a crafted challenge token containing ../ sequences, causing lego to write attacker-influenced content to any path writable by the lego process. This vulnerability is fixed in 4.34.0.

← Browse all CVEs View on cve.org ↗