Vulnerability in Serverco Getssl
CVE-2026-10303
In ServerCo getssl version 2.49 and prior, the ACME challenge token returned to the client was not strictly validated against RFC 8555 before being used in challenge-file handling, allowing a maliciously crafted token to influence local path/filename usage during validation. An attacker who can supply ACME challenge responses to getssl (for example, a malicious or compromised CA endpoint, or an on-path adversary able to tamper with that response path) could exploit this to achieve unauthorized file write/path traversal effects, usually with elevated privileges, ultimately allowing for remote command injection. This issue appears related in spirit to CVE-2023-38198, and is an instance of CWE-73, "External control of file name or path." Other ACME shell script handlers may be affected by similar issues.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.008 (53.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 53rd percentile — 53.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000
Affected products
- Serverco Getssl — versions 0
Weakness classification (CWE)
References
- 44488dab-36db-4358-99f9-bc116477f914 (mitigation)
- 44488dab-36db-4358-99f9-bc116477f914 (related)
- 44488dab-36db-4358-99f9-bc116477f914 (related)
- 44488dab-36db-4358-99f9-bc116477f914 (third-party-advisory)
- 44488dab-36db-4358-99f9-bc116477f914 (release-notes)
Frequently asked questions
- What is CVE-2026-10303?
- CVE-2026-10303 is a high-severity vulnerability in Serverco Getssl, classified under External Control of File Name or Path. CVSS score: 7.4/10. Published 2026-06-16.
- How severe is CVE-2026-10303?
- High severity. CVSS v3 base score is 7.4 out of 10.