lego vulnerabilities

1 known vulnerability in lego from Go-acme. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  lego: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-40611Apr 21, 2026Go-acme

  Let's Encrypt client and ACME library written in Go (Lego). Prior to 4.34.0, the webroot HTTP-01 challenge provider in lego is vulnerable to arbitrary file write and deletion via path traversal. A malicious ACME server can supply a crafted challenge token cont