Arbitrary file write and deletion via traversal

Path traversal in go-acme Lego before 4.34.0 allows remote attackers controlling an ACME server to write or delete local files. ChallengePath concatenates an unvalidated ACME token, after which the webroot provider passes the result through filepath.Join and uses it in WriteFile and Remove operations outside the configured webroot. Exploitation requires the HTTP-01 webroot solver to contact a malicious or compromised ACME server; writable startup or service paths can turn the file write into code execution, while CleanUp can delete files.