PT-2026-33383 · Lego · Lego

Published 2026-04-16 · Updated 2026-04-23 · CVE-2026-40611

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lego versions prior to 4.34.0

Description The webroot HTTP-01 challenge provider in Lego is subject to arbitrary file write and deletion via path traversal. A malicious ACME server can provide a crafted challenge token containing ../ sequences, which the ChallengePath() function concatenates without validation. This allows the server to influence the file path, causing the software to write or delete content at any location writable by the Lego process. The issue occurs because the software fails to enforce the base64url alphabet constraint for ACME tokens as specified in RFC 8555. The vulnerable logic is present in the ChallengePath() function and the CleanUp() function.

Recommendations Update to version 4.34.0.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-40611

GHSA-QQX8-2XMM-JRV8

Affected Products

Lego

References · 11

• 🔥 https://github.com/go-acme/lego/security/advisories/GHSA-qqx8-2xmm-jrv8 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2026-40611 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40611 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-40611 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-40611 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-40611 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-40611 · Security Note
• https://osv.dev/vulnerability/GHSA-qqx8-2xmm-jrv8 · Vendor Advisory
• https://github.com/go-acme/lego · Note
• https://twitter.com/VulmonFeeds/status/2046786925214749147 · Twitter Post
• https://twitter.com/CVEnew/status/2046675003169526207 · Twitter Post