CVE-2026-10303: ServerCo getssl ACME shell script path injection

Synopsis

A path injection vulnerability (CWE-73, external control of file name or path) exists in ServerCo getssl versions 2.49 and earlier, an ACME certificate management shell script. An attacker who can supply a crafted ACME challenge token, either by acting as a malicious or compromised CA endpoint or by intercepting the response over the network (requiring high attack complexity), can manipulate local file path and filename handling during certificate validation. Successful exploitation enables unauthorized file writes and path traversal, typically running with elevated privileges, which can escalate to remote command injection. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the getssl client over the network, either by operating a malicious CA endpoint the client connects to or by positioning themselves on-path to tamper with ACME challenge responses.

• AuthenticationNot required

  No authentication is needed; the attacker exploits the unauthenticated ACME challenge-response exchange.

• Victim interactionNot required

  No user interaction is required; exploitation occurs during the automated certificate validation flow without any human action.

• Attack complexityDetail

  Attack complexity is high, meaning the attacker must either control or compromise the CA endpoint, or establish an on-path position to intercept and tamper with ACME responses, which requires non-trivial setup.

Blast Radius

• Writes arbitrary files to local paths accessible by the getssl process, which typically runs with elevated privileges during certificate issuance.
• Traverses outside intended directories via crafted token values, potentially overwriting sensitive system files or dropping attacker-controlled content.
• Escalates from file write to remote command injection by placing executable content in locations that are subsequently invoked by the host system or automation tooling.
• Confidentiality of high-value files is exposed as a side effect of path traversal, allowing the attacker to infer directory structure and overwrite credential or configuration files.