The go-acme lego client, used for Let's Encrypt ACME challenges, has a path traversal vulnerability in its webroot HTTP-01 challenge provider in versions before 4.34.0. A malicious ACME server can exploit this by providing a challenge token containing directory traversal sequences (../), which lego does not properly sanitize. This leads to arbitrary file write and deletion on the filesystem paths writable by the lego process. The issue is addressed and fixed in version 4.34.0.

Successful exploitation allows an unauthenticated remote attacker (a malicious ACME server) to write or delete arbitrary files on the system where lego runs, limited to paths writable by the lego process. This can lead to full compromise of the affected system's confidentiality, integrity, and availability.

A fix is available in go-acme lego version 4.34.0. Users should upgrade to version 4.34.0 or later to remediate this vulnerability. Patch status is confirmed by the vendor advisory. No alternative mitigations are documented.