Go/github.com/go-acme/lego/v4 CVE-2026-40611: unknown, EPSS 0.55%

ACME Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider in github.com/go-acme/lego

Action: Upgrade github.com/go-acme/lego/v4 to 4.34.0 or later.

go get github.com/go-acme/lego/v4@v4.34.0

Affected

Fixed versions

Sources

• osv: GO-2026-5593
• https://github.com/go-acme/lego/security/advisories/GHSA-qqx8-2xmm-jrv8

CVE-2026-40611 · published 2026-07-24T18:35:55Z · modified 2026-07-24T19:00:24.441014176Z · JSON