CVE-2026-10303

Description

In ServerCo getssl version 2.49 and prior, the ACME challenge token returned to the client was not strictly validated against RFC 8555 before being used in challenge-file handling, allowing a maliciously crafted token to influence local path/filename usage during validation. An attacker who can supply ACME challenge responses to getssl (for example, a malicious or compromised CA endpoint, or an on-path adversary able to tamper with that response path) could exploit this to achieve unauthorized file write/path traversal effects, usually with elevated privileges, ultimately allowing for remote command injection. This issue appears related in spirit to CVE-2023-38198, and is an instance of CWE-73, "External control of file name or path." Other ACME shell script handlers may be affected by similar issues.

PUBLISHED Reserved 2026-05-31 | Published 2026-06-16 | Updated 2026-06-16 | Assigner runZero

Problem types

CWE-73 External control of file name or path

Product status

Credits

remy finder

Tod Beardsley of runZero coordinator

References

github.com/srvrco/getssl/pull/896 mitigation

remyhax.xyz/posts/reproducing-lawful-tls-wiretapping/ related

www.cve.org/CVERecord?id=CVE-2023-38198 related

www.runzero.com/...getssl-acme-cmd-injection-cve-2026-10303/ third-party-advisory

github.com/srvrco/getssl/releases/tag/v2.50 release-notes

cve.org (CVE-2026-10303)

nvd.nist.gov (CVE-2026-10303)

Download JSON