Skip to content
OpenAdvisories

Vendor

go-acme

2 known vulnerabilities.

Products

lego 2
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.8
    CVE-2026-40611

    Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider

    Let's Encrypt client and ACME library written in Go (Lego). Prior to 4.34.0, the webroot HTTP-01 challenge provider in lego is vulnerable to arbitrary file write and deletion via path traversal. A malicious ACME server can supply a crafted challenge token con…

    go-acme lego traefik-3.6 sftpgo Debian Ubuntu Wolfi Go