TI-2026-29346 CVE-2026-40611 · GHSA-qqx8-2xmm-jrv8
Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider
Priority HIGH 73
Let's Encrypt client and ACME library written in Go (Lego).
go-acme
Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9
Exploited now
go-acme records in CISA KEVNo go-acme vulnerabilities are listed in CISA KEV.
Records
2 records
TI-2025-34553 CVE-2025-54799 · GHSA-q82r-2j7m-9rv4
Lego does not enforce HTTPS
Priority LOW 12
Let's Encrypt client and ACME library written in Go (Lego).