Skip to content
OpenAdvisories

Package · Go

github.com/go-acme/lego/v4

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.8
    CVE-2026-40611

    Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider

    Let's Encrypt client and ACME library written in Go (Lego). Prior to 4.34.0, the webroot HTTP-01 challenge provider in lego is vulnerable to arbitrary file write and deletion via path traversal. A malicious ACME server can supply a crafted challenge token con…

    go-acme lego traefik-3.6 sftpgo Debian Ubuntu Wolfi Go