CVE-2026-40611 Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider
A malicious ACME server can exploit path traversal in the webroot provider to write arbitrary files, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-40611?
CVE-2026-40611 is a high-severity path traversal vulnerability in go-acme lego, published on 21 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Let's Encrypt client and ACME library written in Go (Lego). Prior to 4.34.0, the webroot HTTP-01 challenge provider in lego is vulnerable to arbitrary file write and deletion via path traversal. A malicious ACME server can supply a crafted challenge token containing ../ sequences, causing lego to write attacker-influenced content to any path writable by the lego process. This vulnerability is fixed in 4.34.0.
Weakness: CWE-22
Which versions are affected by CVE-2026-40611?
7 open source packages ship an affected version, including github.com/go-acme/lego/v4, github.com/go-acme/lego and github.com/go-acme/lego/v3.
| Package | Affected | Fixed in |
|---|---|---|
github.com/go-acme/lego/v4 Go | All versions | 4.34.0 |
github.com/go-acme/lego/v4 Go | All versions | 4.34.0 |
github.com/go-acme/lego/v4 Go | All versions | 4.34.0 |
github.com/go-acme/lego Go | All versions to 2.7.2 | None |
github.com/go-acme/lego Go | All versions to 2.7.2 | None |
github.com/go-acme/lego/v3 Go | All versions to 3.9.0 | None |
1 more packages
github.com/go-acme/lego/v3 Go | All versions to 3.9.0 | None |
How do I fix CVE-2026-40611?
Upgrade github.com/go-acme/lego/v4 to 4.34.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-40611 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40611 exists.
Sources
Also known as CLEANSTART-2026-KT84205, DEBIAN-CVE-2026-40611, GHSA-qqx8-2xmm-jrv8, GO-2026-5593, MINI-6p9x-gxj9-fq33, MINI-6w5j-2j73-xmf2 and 2 more.