Live › vulnerability › CVE-2026-112198
Go to dashboardThe SAFT import feature of the NoviGest Desktop App parses user-supplied XML with a JAXB Unmarshaller without disabling external entity resolution. A crafted XML file can make the application read files on the local machine that the app process can access.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.
Users of the NoviGest Desktop App who import SAFT XML files, especially files from people they do not trust. The sources do not say which versions are affected or whether the app usually runs with elevated privileges. Teams that do not use this desktop app or its SAFT import can skip it.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
XML External Entity (XXE) injection vulnerability in the SAFT import feature of the NoviGest Desktop App. The application processes user-controlled XML files using a JAXB Unmarshaller without properly disabling external entity resolution. An attacker with access to this functionality could provide a manipulated XML file to read local files accessible to the application process. If the application runs with elevated privileges, sensitive system files could be exposed.
This page as .md · .json · in your agent: get_signal("CVE-2026-112198")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.