PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10303 ServerCo CVE debrief

CVE-2026-10303 is a HIGH severity vulnerability in ServerCo getssl version 2.49 and prior. The issue involves improper validation of ACME challenge tokens, which could allow an attacker to achieve unauthorized file write/path traversal effects and potentially lead to remote command injection. This vulnerability is an instance of CWE-73, 'External control of file name or path.'

Vendor
ServerCo
Product
getssl
CVSS
HIGH 7.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-17
Original CVE updated
2026-06-17
Advisory published
2026-06-17
Advisory updated
2026-06-17

Who should care

Users of ServerCo getssl version 2.49 and prior should apply patches or updates to mitigate this vulnerability. Attackers who can supply ACME challenge responses to getssl could exploit this issue.

Technical summary

In ServerCo getssl version 2.49 and prior, the ACME challenge token returned to the client was not strictly validated against RFC 8555 before being used in challenge-file handling. This allowed a maliciously crafted token to influence local path/filename usage during validation. An attacker who can supply ACME challenge responses to getssl could exploit this to achieve unauthorized file write/path traversal effects, usually with elevated privileges, ultimately allowing for remote command injection.

Defensive priority

HIGH

Recommended defensive actions

  • Apply patches or updates to ServerCo getssl to ensure proper validation of ACME challenge tokens.
  • Restrict access to ACME challenge responses to prevent tampering.
  • Monitor for suspicious activity related to getssl and ACME challenge responses.

Evidence notes

This issue appears related in spirit to CVE-2023-38198, and is an instance of CWE-73, 'External control of file name or path.'

Sources and references

Verified primary and authoritative sources

  • CVE-2026-10303 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-10303

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-10303 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-10303

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://github.com/srvrco/getssl/pull/896

    44488dab-36db-4358-99f9-bc116477f914

  • Source reference

    Unverified legacy reference

    URL: https://github.com/srvrco/getssl/releases/tag/v2.50

    44488dab-36db-4358-99f9-bc116477f914

  • Source reference

    Unverified legacy reference

    URL: https://remyhax.xyz/posts/reproducing-lawful-tls-wiretapping/

    44488dab-36db-4358-99f9-bc116477f914

  • Source reference

    Unverified legacy reference

    URL: https://www.cve.org/CVERecord?id=CVE-2023-38198

    44488dab-36db-4358-99f9-bc116477f914

  • Source reference

    Unverified legacy reference

    URL: https://www.runzero.com/advisories/serverco-getssl-acme-cmd-injection-cve-2026-10303/

    44488dab-36db-4358-99f9-bc116477f914

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.