CVE-2026-10303 ServerCo CVE debrief

Who should care

Users of ServerCo getssl version 2.49 and prior should apply patches or updates to mitigate this vulnerability. Attackers who can supply ACME challenge responses to getssl could exploit this issue.

Technical summary

In ServerCo getssl version 2.49 and prior, the ACME challenge token returned to the client was not strictly validated against RFC 8555 before being used in challenge-file handling. This allowed a maliciously crafted token to influence local path/filename usage during validation. An attacker who can supply ACME challenge responses to getssl could exploit this to achieve unauthorized file write/path traversal effects, usually with elevated privileges, ultimately allowing for remote command injection.

Defensive priority

HIGH

Recommended defensive actions

• Apply patches or updates to ServerCo getssl to ensure proper validation of ACME challenge tokens.
• Restrict access to ACME challenge responses to prevent tampering.
• Monitor for suspicious activity related to getssl and ACME challenge responses.

Evidence notes

This issue appears related in spirit to CVE-2023-38198, and is an instance of CWE-73, 'External control of file name or path.'

Official resources