ServerCo getssl ACME shell script path injection

Executive summary #

In ServerCo getssl version 2.49 and prior, the ACME challenge token returned to the client was not strictly validated against RFC 8555 before being used in challenge-file handling, allowing a maliciously crafted token to influence local path/filename usage during validation.

Technical details #

While not this specific issue, remy noticed this attack pattern was possible in the issue CVE-2023-38198, and documented this related issue in his blogged investigation, Reproducing Lawful TLS Wiretapping.

Attacker value #

An attacker who can supply ACME challenge responses to getssl (for example, a malicious or compromised CA endpoint, or an on-path adversary able to tamper with that response path) could exploit this to achieve unauthorized file write/path traversal effects, usually with elevated privileges, ultimately allowing for remote command injection.

Credit #

This issue was discovered, reported, and fixed by remy. CVE coordination was performed by Tod Beardsley of runZero, Inc.

Timeline #

2026-05-30 (Sat) - Discovered and provided a patch in PR 896 to the vendor

2026-05-31 (Sun) - Disclosed to runZero for CVE coordination

2026-06-01 (Mon) - VINCE case VU#750307 opened with CISA, given possible downstream impacts

2026-06-02 (Tue) - CISA case handler located the vendor's responsive contact information

2026-06-04 (Thu) - Vendor released a fixed version, 2.50

2026-06-16 (Tue) - This public disclosure