High severity8.8NVD Advisory· Published Apr 21, 2026· Updated Apr 22, 2026
CVE-2026-40611
CVE-2026-40611
Description
Let's Encrypt client and ACME library written in Go (Lego). Prior to 4.34.0, the webroot HTTP-01 challenge provider in lego is vulnerable to arbitrary file write and deletion via path traversal. A malicious ACME server can supply a crafted challenge token containing ../ sequences, causing lego to write attacker-influenced content to any path writable by the lego process. This vulnerability is fixed in 4.34.0.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/go-acme/lego/v4Go | < 4.34.0 | 4.34.0 |
github.com/go-acme/lego/v3Go | <= 3.9.0 | — |
github.com/go-acme/legoGo | <= 2.7.2 | — |
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3News mentions
0No linked articles in our index yet.