Skip to content
Fencer Vulns
high 8.8

CVE-2026-40611 json

Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider

published 2026-04-16 6 mo ago modified 2026-10-26 13 d ago also GHSA-qqx8-2xmm-jrv8 , GO-2026-5593 , EUVD-2026-24219

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 36%
public exploits
0
none known

Summary

Let's Encrypt client and ACME library written in Go (Lego). Prior to 4.34.0, the webroot HTTP-01 challenge provider in lego is vulnerable to arbitrary file write and deletion via path traversal. A malicious ACME server can supply a crafted challenge token containing ../ sequences, causing lego to write attacker-influenced content to any path writable by the lego process. This vulnerability is fixed in 4.34.0.

Patch / fix

  • go github.com/go-acme/lego/v4 4.34.0
  • Red Hat Red Hat OpenShift Dev Spaces 3.28 1779786779
  • golang-github-xenolf-lego Debian 14 4.35.2-1

debian advisories DEBIAN-CVE-2026-40611

  • govulncheck-vulndb SLES 16.0, SLES for SAP applications 16.0 0.0.20260727T201416-160000.1.1

suse advisories SUSE-SU-2026:23216-1SUSE-SU-2026:23227-1

  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260727T201416-160000.1.1

opensuse advisories openSUSE-SU-2026:21551-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-40611 updated cvss 8.8

github.com/go-acme/lego: Lego: Arbitrary file write and deletion via path traversal from a malicious ACME server

  • Red Hat OpenShift Dev Spaces 3.28 devspaces/traefik-rhel9 1779786779
    fixed: vendor fix RHSA-2026:21772
  • Red Hat OpenShift Dev Spaces 3.28 devspaces/udi-rhel9 1779829736, devspaces/code-rhel9 1779814592, devspaces/server-rhel9 1779342423, devspaces/openvsx-rhel9 1779528224, devspaces/udi-base-rhel9 1779741066, devspaces/code-sshd-rhel9 1779813519, +9 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
6 mo ago

Exploit prediction

0.42% chance of exploitation in the next 30 days, higher than 36% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/go-acme/lego/security/advisories/GHSA-qqx8-2xmm-jrv8 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA ADP 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
GitHub 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
go github.com/go-acme/lego/v4
<4.34.0
4.34.0
go github.com/go-acme/lego/v3
<=3.9.0
 no fix listed
go github.com/go-acme/lego
<=2.7.2
 no fix listed

Affected products

  • go-acme lego
  • Red Hat Red Hat OpenShift Dev Spaces 3.28

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.