Log in Start free

Vulnerability · Published Apr 21, 2026 · Assigned by GitHub_M

CVE-2026-40611Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider

High 8.8

In plain English

A high-severity path traversal in lego from go-acme. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.4%top 63.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Let's Encrypt client and ACME library written in Go (Lego). Prior to 4.34.0, the webroot HTTP-01 challenge provider in lego is vulnerable to arbitrary file write and deletion via path traversal. A malicious ACME server can supply a crafted challenge token containing ../ sequences, causing lego to write attacker-influenced content to any path writable by the lego process. This vulnerability is fixed in 4.34.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12golang-github-xenolf-legono fix listedDEBIAN-CVE-2026-40611
Debian:13golang-github-xenolf-legono fix listedDEBIAN-CVE-2026-40611
Debian:14golang-github-xenolf-lego4.35.2-1DEBIAN-CVE-2026-40611
Gogithub.com/go-acme/legono fix listedGHSA-qqx8-2xmm-jrv8
Gogithub.com/go-acme/lego/v3no fix listedGHSA-qqx8-2xmm-jrv8
Gogithub.com/go-acme/lego/v44.34.0GHSA-qqx8-2xmm-jrv8
Gogithub.com/go-acme/lego/v44.34.0GO-2026-5593
Ubuntu:22.04:LTSgolang-github-xenolf-legono fix listedUBUNTU-CVE-2026-40611
Ubuntu:25.10golang-github-xenolf-legono fix listedUBUNTU-CVE-2026-40611
Ubuntu:26.04:LTSgolang-github-xenolf-legono fix listedUBUNTU-CVE-2026-40611
Ubuntu:26.10golang-github-xenolf-legono fix listedUBUNTU-CVE-2026-40611

Affected products (as reported)

VendorProductVersions
go-acme lego < 4.34.0

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References