Skip to content
CVE PROGRAM SOURCE RECORD8.2 High

CVE-2026-93570

XML External Entity injection in Szafir and Szafir Weryfikująca

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
CERT-PL

Description

Szafir and Szafir Weryfikująca are vulnerable to XML External Entity (XXE) injection. When a user signs or verify a crafted XML file containing a `DOCTYPE` with an external DTD reference, the parser processes external entities, allowing an attacker to read arbitrary files from the victim's filesystem. This issue was fixed in Szafir version 2.0 build 708. Szafir Weryfikująca is no longer supported (End of Life) and has not been fixed.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Krajowa Izba Rozliczeniowa Szafir

Default version status: unaffected

  • 0 to ≤ 2.0.0affected

Krajowa Izba Rozliczeniowa Szafir Weryfikująca

Default version status: affected

  • 0 to ≤ 1.0affected

References