Executive brief
Lego, a tool used to obtain security certificates from Let's Encrypt, contains a flaw that allows a malicious server to write or delete files on the user's system. If a user connects to a compromised or malicious certificate authority, the attacker can place files in sensitive locations, potentially leading to a full system takeover or data loss. This is particularly dangerous if the tool is running with high-level administrative privileges.
Technical details
A path traversal vulnerability (CWE-22) exists in the webroot HTTP-01 challenge provider of the lego library. The ChallengePath() function fails to validate ACME tokens, which are expected to be base64url encoded but are instead directly concatenated to file paths. By providing a token containing '../' sequences, a malicious ACME server can force lego to write attacker-controlled content to any path writable by the process or delete arbitrary files during the cleanup phase. Exploitation requires the user to point lego at a malicious server using the --server flag while utilizing the --http.webroot provider. This vulnerability is fixed in version 4.34.0.
Affected products
- go-acme lego < 4.34.0
- Red Hat Red Hat OpenShift Dev Spaces 3.28 3.28
Timeline
- 2026-04-15: advisory: GitHub Security Advisory published by maintainers
- 2026-04-21: disclosed: CVE published to NVD
- 2026-05-28: patched: Red Hat released security advisory RHSA-2026:21772 for OpenShift Dev Spaces