Path Traversal Vulnerability in Lego ACME Client by Let's Encrypt

CVE-2026-40611

What is CVE-2026-40611?

The Lego ACME client, developed by Let's Encrypt, is susceptible to a path traversal vulnerability through its webroot HTTP-01 challenge provider. An attacker can exploit this vulnerability by sending a specially crafted challenge token with ../ sequences, allowing them to manipulate files anywhere within the writable paths of the Lego process. This can lead to unauthorized file writes and deletions, posing a significant security risk. The issue has been addressed in version 4.34.0, highlighting the importance of upgrading to the latest version for users reliant on this client.

References