{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-40611",
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "state": "PUBLISHED",
        "assignerShortName": "GitHub_M",
        "dateReserved": "2026-04-14T14:07:59.642Z",
        "datePublished": "2026-04-21T17:58:35.221Z",
        "dateUpdated": "2026-07-15T01:00:42.598Z"
    },
    "containers": {
        "cna": {
            "title": "Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider",
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "cweId": "CWE-22",
                            "lang": "en",
                            "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
                            "type": "CWE"
                        }
                    ]
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "attackComplexity": "LOW",
                        "attackVector": "NETWORK",
                        "availabilityImpact": "HIGH",
                        "baseScore": 8.8,
                        "baseSeverity": "HIGH",
                        "confidentialityImpact": "HIGH",
                        "integrityImpact": "HIGH",
                        "privilegesRequired": "NONE",
                        "scope": "UNCHANGED",
                        "userInteraction": "REQUIRED",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                        "version": "3.1"
                    }
                }
            ],
            "references": [
                {
                    "name": "https://github.com/go-acme/lego/security/advisories/GHSA-qqx8-2xmm-jrv8",
                    "tags": [
                        "x_refsource_CONFIRM"
                    ],
                    "url": "https://github.com/go-acme/lego/security/advisories/GHSA-qqx8-2xmm-jrv8"
                }
            ],
            "affected": [
                {
                    "vendor": "go-acme",
                    "product": "lego",
                    "versions": [
                        {
                            "version": "< 4.34.0",
                            "status": "affected"
                        }
                    ]
                }
            ],
            "providerMetadata": {
                "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
                "shortName": "GitHub_M",
                "dateUpdated": "2026-04-21T17:58:35.221Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "Let's Encrypt client and ACME library written in Go (Lego). Prior to 4.34.0, the webroot HTTP-01 challenge provider in lego is vulnerable to arbitrary file write and deletion via path traversal. A malicious ACME server can supply a crafted challenge token containing ../ sequences, causing lego to write attacker-influenced content to any path writable by the lego process. This vulnerability is fixed in 4.34.0."
                }
            ],
            "source": {
                "advisory": "GHSA-qqx8-2xmm-jrv8",
                "discovery": "UNKNOWN"
            }
        },
        "adp": [
            {
                "references": [
                    {
                        "url": "https://github.com/go-acme/lego/security/advisories/GHSA-qqx8-2xmm-jrv8",
                        "tags": [
                            "exploit"
                        ]
                    }
                ],
                "metrics": [
                    {
                        "other": {
                            "type": "ssvc",
                            "content": {
                                "timestamp": "2026-04-21T19:17:50.782641Z",
                                "id": "CVE-2026-40611",
                                "options": [
                                    {
                                        "Exploitation": "poc"
                                    },
                                    {
                                        "Automatable": "no"
                                    },
                                    {
                                        "Technical Impact": "total"
                                    }
                                ],
                                "role": "CISA Coordinator",
                                "version": "2.0.3"
                            }
                        }
                    }
                ],
                "title": "CISA ADP Vulnrichment",
                "providerMetadata": {
                    "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
                    "shortName": "CISA-ADP",
                    "dateUpdated": "2026-04-21T19:17:54.210Z"
                }
            },
            {
                "affected": [
                    {
                        "collectionURL": "https://catalog.redhat.com/software/containers/",
                        "cpes": [
                            "cpe:/a:redhat:openshift_devspaces:3.28::el9"
                        ],
                        "defaultStatus": "affected",
                        "packageName": "devspaces/traefik-rhel9",
                        "product": "Red Hat OpenShift Dev Spaces 3.28",
                        "vendor": "Red Hat",
                        "versions": [
                            {
                                "lessThan": "*",
                                "status": "unaffected",
                                "version": "1779786779",
                                "versionType": "rpm"
                            }
                        ]
                    }
                ],
                "datePublic": "2026-04-21T17:58:35.221Z",
                "descriptions": [
                    {
                        "lang": "en",
                        "value": "A flaw was found in lego, the Let's Encrypt client and ACME library written in Go. A malicious ACME (Automated Certificate Management Environment) server can exploit a path traversal vulnerability in the webroot HTTP-01 challenge provider. By supplying a specially crafted challenge token containing directory traversal sequences, the server can cause lego to write or delete files in arbitrary locations on the system where lego is running, potentially leading to system compromise."
                    }
                ],
                "metrics": [
                    {
                        "other": {
                            "content": {
                                "namespace": "https://access.redhat.com/security/updates/classification/",
                                "value": "Important"
                            },
                            "type": "Red Hat severity rating"
                        }
                    },
                    {
                        "cvssV3_1": {
                            "attackComplexity": "LOW",
                            "attackVector": "NETWORK",
                            "availabilityImpact": "HIGH",
                            "baseScore": 8.8,
                            "baseSeverity": "HIGH",
                            "confidentialityImpact": "HIGH",
                            "integrityImpact": "HIGH",
                            "privilegesRequired": "NONE",
                            "scope": "UNCHANGED",
                            "userInteraction": "REQUIRED",
                            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                            "version": "3.1"
                        },
                        "format": "CVSS"
                    }
                ],
                "problemTypes": [
                    {
                        "descriptions": [
                            {
                                "cweId": "CWE-22",
                                "description": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
                                "lang": "en",
                                "type": "CWE"
                            }
                        ]
                    }
                ],
                "references": [
                    {
                        "tags": [
                            "vdb-entry",
                            "x_refsource_REDHAT"
                        ],
                        "url": "https://access.redhat.com/security/cve/CVE-2026-40611"
                    },
                    {
                        "name": "RHBZ#2460233",
                        "tags": [
                            "issue-tracking",
                            "x_refsource_REDHAT"
                        ],
                        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460233"
                    },
                    {
                        "tags": [
                            "x_sadp-csaf-vex"
                        ],
                        "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40611.json"
                    },
                    {
                        "tags": [
                            "vendor-advisory",
                            "x_refsource_REDHAT"
                        ],
                        "url": "https://access.redhat.com/errata/RHSA-2026:21772"
                    }
                ],
                "solutions": [
                    {
                        "lang": "en",
                        "value": "RHSA-2026:21772: Red Hat OpenShift Dev Spaces 3.28"
                    }
                ],
                "timeline": [
                    {
                        "lang": "en",
                        "time": "2026-04-21T20:01:57.383Z",
                        "value": "Reported to Red Hat."
                    },
                    {
                        "lang": "en",
                        "time": "2026-04-21T17:58:35.221Z",
                        "value": "Made public."
                    }
                ],
                "title": "github.com/go-acme/lego: Lego: Arbitrary file write and deletion via path traversal from a malicious ACME server",
                "workarounds": [
                    {
                        "lang": "en",
                        "value": "To mitigate this issue, ensure that the `lego` client only interacts with trusted ACME servers. Additionally, run the `lego` process with the least necessary privileges and in a restricted environment to limit the potential impact of arbitrary file operations. This may involve containerization or specific filesystem access controls."
                    }
                ],
                "x_adpType": "supplier",
                "x_generator": {
                    "engine": "sadp-cli 1.0.0"
                },
                "providerMetadata": {
                    "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
                    "shortName": "redhat-SADP",
                    "dateUpdated": "2026-07-15T01:00:42.598Z"
                }
            }
        ]
    }
}