Zurück zur CVE-Übersicht
CVE-2026-40611
HIGH(8.8)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Risk Signal Score22/100 — NIEDRIG
- CVSS 8.8 — Hoch
EPSS-Score
0%
Exploit-Wahrscheinlichkeit (30 Tage)
CVSS Score
8.8
Technische Schwere
Beschreibung
Let's Encrypt client and ACME library written in Go (Lego). Prior to 4.34.0, the webroot HTTP-01 challenge provider in lego is vulnerable to arbitrary file write and deletion via path traversal. A malicious ACME server can supply a crafted challenge token containing ../ sequences, causing lego to write attacker-influenced content to any path writable by the lego process. This vulnerability is fixed in 4.34.0.
Referenzen
- https://github.com/go-acme/lego/security/advisories/GHSA-qqx8-2xmm-jrv8
- https://access.redhat.com/errata/RHSA-2026:21772
- https://access.redhat.com/security/cve/CVE-2026-40611
- https://bugzilla.redhat.com/show_bug.cgi?id=2460233
- https://github.com/go-acme/lego/security/advisories/GHSA-qqx8-2xmm-jrv8
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40611.json