A critical path traversal vulnerability in the Go-acme Lego library allows a malicious ACME server to execute arbitrary file operations on the host, posing a significant risk of system compromise.

This flaw involves an improper limitation of a pathname to a restricted directory (CWE-22) within the webroot HTTP-01 challenge provider. An unauthenticated attacker acting as a malicious ACME server can supply a crafted challenge token containing path traversal sequences, forcing the application to perform file operations outside its intended directory.

The ability to write or delete arbitrary files on the host system provides an attacker with a direct path to remote code execution or system disruption. Given the CVSS score of 8.8, this vulnerability is classified as High severity and represents a major security risk to any infrastructure relying on Lego for ACME certificate management.

Immediate Action: Update the Go-acme Lego library to version 4.34.0 or later to include the mandatory security fix.

Proactive Monitoring: Review system logs for unusual file write operations, particularly those targeting system configuration directories or sensitive binary paths.

Compensating Controls: Ensure that the Lego process runs with the least privilege necessary, strictly isolating the service account from sensitive system files to limit the potential impact of a successful traversal.

Public Exploit Available: Unknown

Organizations using the Lego library for certificate automation must prioritize this update, as the flaw allows for unauthorized file system modification. Administrators should verify their current library versions immediately and apply the 4.34.0 patch to neutralize the threat of arbitrary file writing and deletion.