CVE-2026-93570: XML External Entity injection in Szafir and Szafir Weryfikująca
Szafir and Szafir Weryfikująca are vulnerable to XML External Entity (XXE) injection. When a user signs or verify a crafted XML file containing a DOCTYPE with an external DTD reference, the parser processes external entities, allowing an attacker to read arbitrary files from the victim's filesystem.
This issue was fixed in Szafir version 2.0 build 708. Szafir Weryfikująca is no longer supported (End of Life) and has not been fixed.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Szafirto a version that resolves this vulnerability.Fixed in 2.0 build 708
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of vulnerable Szafir versions and users of Szafir Weryfikująca are exposed when they sign or verify a crafted XML file. Szafir Weryfikująca is end of life and has not received a fix.
What must an attacker do to exploit the vulnerability?
An attacker must persuade a user to sign or verify a crafted XML document containing a DOCTYPE that references an external DTD. Exploitation requires user interaction, but no attacker privileges are required.
What is the impact of successful exploitation?
The crafted XML can cause the parser to process external entities and disclose arbitrary files from the victim's filesystem. The provided severity vector also indicates potential confidentiality impact on a subsequent system.
What remediation is available?
Upgrade Szafir to version 2.0 build 708, which fixes the issue. Szafir Weryfikująca has no fix because it is no longer supported.