ACME Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider
Date: 2026-04
Affected: go/github.com/go-acme/lego, go/github.com/go-acme/lego/v3, go/github.com/go-acme/lego/v4
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-40611
CWE: CWE-22
CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

### Summary The webroot HTTP-01 challenge provider in lego is vulnerable to arbitrary file write and deletion via path traversal. A malicious ACME server can supply a crafted challenge token containing `../` sequences, causing lego to write attacker-influenced content to any path writable by the lego process. ### Details The `ChallengePath()` function in `challenge/http01/http_challenge.go:26-27` constructs the challenge file path by directly concatenating the ACME token without any validation: ```go func ChallengePath(token string) string { return "/.well-known/acme-challenge/" + token } ``` The webroot provider in `providers/http/webroot/webroot.go:31` then joins this with the configured webroot directory and writes the key authorization content to the resulting path: ```go challengeFilePath := filepath.Join(w.path, http01.ChallengePath(token)) err = os.MkdirAll(filepath.Dir(challengeFilePath), 0o755) err = os.WriteFile(challengeFilePath, []byte(keyAuth), 0o644) ``` RFC 8555 Section 8.3 specifies that ACME tokens must only contain characters from the base64url alphabet (`[A-Za-z0-9_-]`), but this constraint is never enforced anywhere in the codebase. When a malicious ACME server returns a token such as `../../../../../../tmp/evil`, `filepath.Join()` resolves the `..` components, producing a path outside the webroot directory. The same vulnerability exists in the `CleanUp()` function at `providers/http/webroot/webroot.go:48`, which deletes the challenge file using


Mitigations:

Architectural layers (MAESTRO):