Lego ACME Client Vulnerable to Path Traversal, Arbitrary File Write

The National Vulnerability Database has disclosed CVE-2026-40611, a high-severity path traversal vulnerability in Lego, the popular Let’s Encrypt client and ACME library written in Go. Prior to version 4.34.0, Lego’s webroot HTTP-01 challenge provider is susceptible to arbitrary file write and deletion. This flaw carries a CVSS score of 8.8 (HIGH).

Attackers can exploit this by operating a malicious ACME server. Such a server could supply a specially crafted challenge token containing directory traversal sequences (e.g., ../). This malicious token would trick the vulnerable Lego client into writing attacker-influenced content to any file path writable by the Lego process, or even deleting existing files. This is a critical arbitrary file write primitive.

For defenders, this means a compromised or malicious ACME server could gain arbitrary write access on systems running vulnerable Lego clients. This could lead to code execution, data manipulation, or denial of service. The fix is available in Lego version 4.34.0. Organizations must prioritize upgrading their Lego deployments immediately to mitigate this significant risk.