CVE-2026-10303: ServerCo getssl ACME Token Validation Flaw Enables Path Traversal

Technical summary

The vulnerability exists in getssl's handling of ACME challenge tokens defined in RFC 8555. The application does not enforce strict validation of token content before using it in local file path construction during challenge-file operations. Specifically, an attacker supplying a maliciously crafted ACME response can control or influence the file paths or filenames used by getssl, creating a path traversal condition (CWE-73). This mirrors the mechanics of CVE-2023-38198 and leverages the trust boundary between getssl and the ACME endpoint. Exploitation requires the attacker to intercept or impersonate ACME server responses—either through network interception or by compromising the CA endpoint itself.

Business impact

Organizations relying on getssl for automated certificate renewal face disruption and compliance risk. A compromised getssl instance could be used to deploy malware, alter application configuration, or create backdoors on systems managing TLS certificates. This is particularly concerning in infrastructure where certificate renewal is automated and runs unattended with root or service-account privileges. Affected deployments may also face forensic and remediation overhead if malicious file writes go undetected.

Affected systems

ServerCo getssl version 2.49 and all prior versions are affected. The vulnerability is triggered when getssl interacts with ACME endpoints (typically Let's Encrypt or compatible services) and receives crafted challenge responses. Any automation or scheduled certificate renewal using vulnerable getssl versions in environments where network interception is feasible or where the ACME endpoint trust model is questionable represents a potential attack surface.

Exploitability

Exploitation requires the attacker either to be on the network path between getssl and its configured ACME endpoint, or to compromise the ACME CA endpoint itself. Both are achievable but non-trivial scenarios. An on-path attacker needs network position and the ability to intercept HTTPS traffic (or exploit HTTPS validation weaknesses). A CA compromise is a sophisticated attack but would affect many victims. The CVSS score of 7.4 (HIGH) reflects the high-impact file write capability offset by the moderately difficult attack position (network adjacency or CA compromise required).

Remediation

Upgrade to a version of getssl that implements strict RFC 8555 token validation. Verify the exact patched version number against the ServerCo advisory. Until patching is possible, segregate getssl instances from untrusted networks, use TLS certificate pinning or strict validation of the ACME endpoint, and run getssl with the minimum privileges necessary. Monitor file write activity on systems running getssl for signs of unexpected path traversal or file creation in sensitive directories.

Patch guidance

Consult the ServerCo security advisory for the specific patched version. Patching should be prioritized for getssl instances that renew certificates for production services or that run with elevated privileges. Test the update in a non-production environment first, as certificate renewal automation must remain reliable. If you operate a custom fork or wrapper around getssl, audit your integration for similar token-handling logic.

Detection guidance

Monitor getssl process execution and audit its file write operations, especially writes outside expected certificate and log directories. Use filesystem integrity monitoring or auditd to alert on unexpected file creation in system directories. Analyze HTTPS traffic from getssl clients to the ACME endpoint for signs of token injection or anomalous challenge-response payloads. Check getssl logs for errors or unexpected file path messages that might indicate a failed exploitation attempt. Organizations should also review ACME endpoint access logs for suspicious response patterns.

Why prioritize this

This vulnerability scores HIGH and affects a critical infrastructure automation tool. Certificate renewal is often automatic and privileged. Attackers can leverage ACME response tampering to achieve file-write and potentially code-execution effects. Although exploitation requires either network adjacency or CA compromise, the impact is severe enough to warrant rapid patching, especially in internet-facing or sensitive environments. Prioritize systems where getssl runs with root or service-account privileges.

Risk score, explained

CVSS 3.1 score of 7.4 reflects: (1) Network attack vector—the attacker can craft malicious ACME responses remotely; (2) High complexity—exploitation requires favorable network conditions or CA compromise; (3) No privilege escalation or user interaction required once the network position is achieved; (4) Integrity and confidentiality impact—unauthorized file writes can lead to code execution, system compromise, or information disclosure; (5) No availability impact in the base case, though remediation and response may affect service uptime.

Frequently asked questions