Affected: CleanStart: forecastle

Security vulnerability affects the forecastle package. This issue is resolved in later releases. See references for vulnerability details.

Let's Encrypt client and ACME library written in Go (Lego). Prior to 4.34.0, the webroot HTTP-01 challenge provider in lego is vulnerable to arbitrary file write and deletion via path traversal. A malicious ACME server can supply a crafted challenge token containing ../ sequences, causing lego to write attacker-influenced content to any path writable by the lego process. This vulnerability is fixed in 4.34.0.

Affected: Go: github.com/go-acme/lego/v4, Go: github.com/go-acme/lego/v3, Go: github.com/go-acme/lego

### Summary

The webroot HTTP-01 challenge provider in lego is vulnerable to arbitrary file write and deletion via path traversal. A malicious ACME server can supply a crafted challenge token containing `../` sequences, causing lego to write attacker-influenced content to any path writable by the lego process.

### Details

The `ChallengePath()` function in `challenge/http01/http_challenge.go:26-27` constructs the challenge file path by directly concatenating the ACME token without any validation:

```go func ChallengePath(token string) string { return "/.well-known/acme-challenge/" + token } ```

The webroot provider in `providers/http/webroot/webroot.go:31` then joins this with the configured webroot directory and writes the key authorization content to the resulting path:

```go challengeFilePath := filepath.Join(w.path, http01.ChallengePath(token)) err = os.MkdirAll(filepath.Dir(challengeFilePath), 0o755) err = os.WriteFile(challengeFilePath, []byte(keyAuth), 0o644) ```

RFC 8555 Section 8.3 specifies that ACME tokens must only contain characters from the base64url alphabet (`[A-Za-z0-9_-]`), but this constraint is never enforced anywhere in the codebase. When a malicious ACME server returns a token such as `../../../../../../tmp/evil`, `filepath.Join()` resolves the `..` components, producing a path outside the webroot directory.

The same vulnerability exists in the `CleanUp()` function at `providers/http/webroot/webroot.go:48`, which deletes the challenge file using…

bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression undici: undici: Denial of Service via crafted WebSocket frame with large length org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter markdown-it: markdown-it: Denial of Service via Regular Expression Denial of Service in linkify function bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid minimatch: minimatch: Denial of Service via specially crafted glob patterns minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions svgo: SVGO: Denial of Service via XML entity expansion express-rate-limit: express-rate-limit: Denial of Service for IPv4 clients due to incorrect IPv6 subnet masking tar: tar: File overwrite via drive-relative symlink traversal flatted: flatted: Unbounded recursion DoS in parse() revive phase crypto/x509: crypto/tls: golang: Go: Denial of Service vulnera…

Affected: Ubuntu:18.04:LTS: golang-github-xenolf-lego, Ubuntu:20.04:LTS: golang-github-xenolf-lego, Ubuntu:22.04:LTS: golang-github-xenolf-lego, Ubuntu:Pro:24.04:LTS: golang-github-xenolf-lego, Ubuntu:25.10: golang-github-xenolf-lego, Ubuntu:26.04:LTS: golang-github-xenolf-lego

Let's Encrypt client and ACME library written in Go (Lego). Prior to 4.34.0, the webroot HTTP-01 challenge provider in lego is vulnerable to arbitrary file write and deletion via path traversal. A malicious ACME server can supply a crafted challenge token containing ../ sequences, causing lego to write attacker-influenced content to any path writable by the lego process. This vulnerability is fixed in 4.34.0.