CVE-2025-47220: Medium severity Keyfactor Signserver vulnerability
A local file enumeration was found in Keyfactor SignServer versions prior to 7.3.2 .The property VISIBLESIGNATURECUSTOMIMAGEPATH, which exists in the PDFSigner and the PAdESSigner, can be set to any path without any restrictions by an admin user. In the case that the provided path points to an existing file, readable by the user running the application server, but is not a recognized image format, it will return this as an error to the clientside, confirming the existences of the file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-47220?
CVE-2025-47220 is classified as a medium severity vulnerability due to its incorrect access control issue.
How do I fix CVE-2025-47220?
To fix CVE-2025-47220, you should upgrade Keyfactor SignServer to version 7.3.1 or later.
What versions of Keyfactor SignServer are affected by CVE-2025-47220?
All versions of Keyfactor SignServer prior to 7.3.1 are affected by CVE-2025-47220.
What kind of vulnerability is CVE-2025-47220?
CVE-2025-47220 is an Incorrect Access Control vulnerability.
Is there any workaround for CVE-2025-47220?
There are no known workarounds for CVE-2025-47220 other than upgrading to the fixed version.