Skip to content
OpenAdvisories

Package · Go

github.com/go-acme/lego/v4

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 8.8
    CVE-2026-40611

    Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider

    Let's Encrypt client and ACME library written in Go (Lego). Prior to 4.34.0, the webroot HTTP-01 challenge provider in lego is vulnerable to arbitrary file write and deletion via path traversal. A malicious ACME server can supply a crafted challenge token con…

    go-acme lego traefik-3.6 sftpgo Debian Ubuntu Wolfi Go
  • Low 2.3
    CVE-2025-54799

    Lego does not enforce HTTPS

    Let's Encrypt client and ACME library written in Go (Lego). In versions 4.25.1 and below, the github.com/go-acme/lego/v4/acme/api package (thus the lego library and the lego cli as well) don't enforce HTTPS when talking to CAs as an ACME client. Unlike the ht…

    go-acme lego sftpgo terraform-provider-acme Debian Ubuntu Wolfi Go