CVE-2026-93570
Szafir and Szafir Weryfikująca are vulnerable to XML External Entity (XXE) injection
- Risk score
- 54/100
- CVSS
- 8.2 v4.0
- Published
- 29 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Szafir and Szafir Weryfikująca are vulnerable to XML External Entity (XXE) injection. When a user signs or verify a crafted XML file containing a DOCTYPE with an external DTD reference, the parser processes external entities, allowing an attacker to read arbitrary files from the victim's filesystem. This issue was fix…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.2 high
- Remotely exploitable without logging in
References
Original description
Szafir and Szafir Weryfikująca are vulnerable to XML External Entity (XXE) injection. When a user signs or verify a crafted XML file containing a `DOCTYPE` with an external DTD reference, the parser processes external entities, allowing an attacker to read arbitrary files from the victim's filesystem. This issue was fixed in Szafir version 2.0 build 708. Szafir Weryfikująca is no longer supported (End of Life) and has not been fixed.
Last activity 29 Oct 2026. Patch Forecast updates every hour.