Threats affecting pkg:github/getssl

CVE-2026-10303 is a high-severity vulnerability in ServerCo getssl version 2.49 and earlier. The ACME challenge token returned to the client is not properly validated against RFC 8555, allowing crafted tokens to influence local file path or name handling. This can lead to unauthorized file writes or path traversal, potentially enabling remote command injection with elevated privileges. The vulnerability relates to CWE-73, external control of file name or path. No official patch or remediation guidance is currently available.