CVE-2026-93570 PUBLISHED

XML External Entity injection in Szafir and Szafir Weryfikująca

Assigner: CERT-PL
Reserved: 18.09.2026 Published: 29.10.2026 Updated: 29.10.2026

Szafir and Szafir Weryfikująca are vulnerable to XML External Entity (XXE) injection. When a user signs or verify a crafted XML file containing a DOCTYPE with an external DTD reference, the parser processes external entities, allowing an attacker to read arbitrary files from the victim's filesystem.

This issue was fixed in Szafir version 2.0 build 708. Szafir Weryfikująca is no longer supported (End of Life) and has not been fixed.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
CVSS Score: 8.2

Product Status

Vendor Krajowa Izba Rozliczeniowa
Product Szafir
Versions Default: unaffected
  • affected from 0 to 2.0.0 (incl.)
Vendor Krajowa Izba Rozliczeniowa
Product Szafir Weryfikująca
Versions Default: affected
  • affected from 0 to 1.0 (incl.)

Credits

  • Mikus Teivens, Critical Security finder

References

Problem Types

  • CWE-611 Improper restriction of XML external entity reference CWE