{"id":"GO-2026-5593","revision":"55f98faa9c774e6aaea0ff658b151998","records":[{"revision":"55f98faa9c774e6aaea0ff658b151998","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5593","aliases":["CVE-2026-40611","GHSA-qqx8-2xmm-jrv8"],"title":"ACME Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider in github.com/go-acme/lego","description":"ACME Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider in github.com/go-acme/lego","state":0,"publishedAt":"2026-07-24T18:35:55+00:00","modifiedAt":"2026-07-24T19:00:24.4410142+00:00","affected":[{"ecosystem":"Go","name":"github.com/go-acme/lego/v4","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"4.34.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/go-acme/lego/security/advisories/GHSA-qqx8-2xmm-jrv8"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5593","license":"OSV · upstream source license applies","key":"osv:GO-2026-5593","identifiers":["GO-2026-5593","CVE-2026-40611","GHSA-qqx8-2xmm-jrv8"]},"retained":false,"historicalAffected":[]}],"coverage":[]}