Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Let's Encrypt client and ACME library written in Go (Lego). Prior to 4.34.0, the webroot HTTP-01 challenge provider in lego is vulnerable to arbitrary file write and deletion via path traversal. A malicious ACME server can supply a crafted challenge token containing ../ sequences, causing lego to write attacker-influenced content to any path writable by the lego process. This vulnerability is fixed in 4.34.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-21 | 1 | General1 |
| 2026-04-22 | 1 | Disclosure1 |
CVE-2026-40611 Let's Encrypt client and ACME library written in Go (Lego). Prior to 4.34.0, the webroot HTTP-01 challenge provider in lego is vulnerable to arbitrary file write and … https://www.cve.org/CVERecord?id=CVE-2026-40611
Post summary
The text reports a CVE describing an arbitrary file write vulnerability in Let's Encrypt's Lego client prior to version 4.34.0, without mentioning PoC, exploit code, patch, or active exploitation.
CVE-2026-40611 Path Traversal Vulnerability in Lego Let's Encrypt Client Prior to 4.34.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40611
Post summary
The CVE-2026-40611 vulnerability is a path traversal flaw affecting Lego Let's Encrypt client versions before 4.34.0, as announced by the source.