LOWGo
GHSA-q82r-2j7m-9rv4· CVE-2025-54799, GO-2025-3847github.com/go-acme/lego/v4/acme/api does not enforce HTTPS
Modified: 9/10/2026
package
Go/github.com/go-acme/lego/v4
pkg:go/github.com/go-acme/lego/v4
HIGH8.8Go
GHSA-qqx8-2xmm-jrv8· CVE-2026-40611, GO-2026-5593ACME Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider
Modified: 9/10/2026
—Go
GO-2025-3847· CVE-2025-54799, GHSA-q82r-2j7m-9rv4Github.com/go-acme/lego/v4/acme/api does not enforce HTTPS in github.com/go-acme/lego
Modified: 2/4/2026
—Go
GO-2026-5593· CVE-2026-40611, GHSA-qqx8-2xmm-jrv8ACME Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider in github.com/go-acme/lego
Modified: 7/24/2026