GCVE - cpe:2.3:a:serverco:getssl:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:serverco:getssl:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Serverco (`1bdf2c1d-0a78-51c6-8bba-ea9504aaeee6`)
Product	Getssl (`23e5152b-e21e-5b4a-a205-66ea7c7f823d`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-10303`	vulnerable	2026-07-29 00:20:51.998329	ServerCo getssl ACME shell script path injection HIGH (7.4) In ServerCo getssl version 2.49 and prior, the ACME challenge token returned to the client was not strictly validated against RFC 8555 before being used in challenge-file handling, allowing a maliciously crafted token to influence local path/filename usage during validation. An attacker who can supply ACME challenge responses to getssl (for example, a malicious or compromised CA endpoint, or an on-path adversary able to tamper with that response path) could exploit this to achieve unauthorized file write/path traversal effects, usually with elevated privileges, ultimately allowing for remote command injection. This issue appears related in spirit to CVE-2023-38198, and is an instance of CWE-73, "External control of file name or path." Other ACME shell script handlers may be affected by similar issues. Published: 2026-06-16T18:24:43.712Z Updated: 2026-06-17T15:18:11.930Z Open on db.gcve.eu Reference links https://github.com/srvrco/getssl/pull/896 https://remyhax.xyz/posts/reproducing-lawful-tls-wiretapping/ https://www.cve.org/CVERecord?id=CVE-2023-38198 https://www.runzero.com/advisories/serverco-getssl-acme-cmd-injection-cve-2026-10303/ https://github.com/srvrco/getssl/releases/tag/v2.50	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.