ServerCo getssl versions up to 2.49 improperly validate the ACME challenge token against RFC 8555 before using it in challenge-file handling. This lack of strict validation allows an attacker who can supply ACME challenge responses—such as a malicious or compromised CA endpoint or an on-path adversary—to manipulate local file paths or names. Exploitation can result in unauthorized file writes or path traversal, often with elevated privileges, and may lead to remote command injection. This vulnerability is categorized under CWE-73 and is conceptually similar to CVE-2023-38198. No vendor advisory or patch information is currently available.

Successful exploitation allows an attacker to influence file path or name handling during ACME challenge validation, leading to unauthorized file writes or path traversal. This can result in remote command injection with elevated privileges, compromising system integrity and confidentiality. The CVSS 3.1 base score is 7.4 (high), reflecting network attack vector, high impact on confidentiality and integrity, and no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the getssl service and ACME challenge response channels to trusted entities only. Monitor for suspicious activity related to ACME challenge handling and consider isolating affected systems to limit potential impact.