CVE-2026-112198: Improper Restriction of XML External Entity Reference in Tactis' NoviGest Desktop App
Published Oct 28, 2026
·Updated
XML External Entity (XXE) injection vulnerability in the SAFT import feature of the NoviGest Desktop App. The application processes user-controlled XML files using a JAXB Unmarshaller without properly disabling external entity resolution. An attacker with access to this functionality could provide a manipulated XML file to read local files accessible to the application process. If the application runs with elevated privileges, sensitive system files could be exposed.
Affected Software
1 affected component
Tactis NoviGest Desktop App
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tactis NoviGest Desktop Appto a version that resolves this vulnerability.Fixed in 8.0.0-300
Event History
Oct 28, 2026
CVE Published
via MITRE·10:20 AM
Data Sourced
via MITRE·10:20 AM
RemedyDescriptionWeakness