{"id":"CVE-2026-19721","kind":"vulnerability","aliases":["CVE-2026-19721"],"related":[],"title":"İmzager: XML external entity flaw lets attackers read linked data","description":"Improper restriction of XML external entity reference vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute İmzager allows Serialized Data External Linking.\n\nThis issue affects İmzager: from 2.10.5 before 2.10.7.","summary":"İmzager, an electronic signature application from TÜBİTAK BİLGEM, does not restrict XML external entity references in some data it processes. The sources do not say what an attacker can read or whether it can be triggered remotely.","severity":"low","cvss":3.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["imzager","other"],"not_affected_if":["version-outside-range"],"how_to_check":"- Check the installed İmzager version and see whether it is in the range `2.10.5` to before `2.10.7`","fix":"- İmzager: move to `2.10.7` or later","status":"open","published_at":"2026-11-04T09:17:42+00:00","first_seen_at":"2026-11-04T09:26:09+00:00","triaged_at":"2026-11-04T09:26:51+00:00","updated_at":"2026-11-04T09:26:51+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-04T09:26:51Z","model":"claude-haiku-5-5","output":{"fix":"- İmzager: move to `2.10.7` or later","reach":"unknown","title":"İmzager: XML external entity flaw lets attackers read linked data","impact":"low","summary":"İmzager, an electronic signature application from TÜBİTAK BİLGEM, does not restrict XML external entity references in some data it processes. The sources do not say what an attacker can read or whether it can be triggered remotely.","audience":"businesses","category":"other","nicknames":[],"who_cares":["imzager"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"unknown","analyst_note":"Confirm the attacker-reachable path and what data an XXE in İmzager exposes; check the NVD page for the CVSS vector.","how_to_check":"- Check the installed İmzager version and see whether it is in the range `2.10.5` to before `2.10.7`\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Teams running İmzager versions from 2.10.5 before 2.10.7 are affected. The sources do not describe the data path, configuration or role needed to reach the flaw.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000637,"input_tokens":4119,"output_tokens":451,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-19721':13A,16A '-2026':12A,15A '2.10.5':81C '2.10.7':83C 'affect':78C 'allow':71C 'applic':22B 'attack':7A,45B 'bilgem':25B,65C 'cve':11A,14A 'data':10A,35B,73C 'electron':20B 'entiti':4A,31B,60C 'extern':3A,30B,59C,74C 'flaw':5A 'improp':55C 'imzag':1A,17B,18B,70C,79C 'institut':69C 'issu':77C 'let':6A 'link':9A,75C 'process':37B 'read':8A,47B 'refer':32B,61C 'remot':54B 'research':68C 'restrict':28B,56C 'say':42B 'serial':72C 'signatur':21B 'softwar':66C 'sourc':39B 'technolog':67C 'trigger':53B 'tübitak':24B,64C 'vulner':62C 'whether':49B 'xml':2A,29B,58C","nicknames":[],"mitigations":[],"who_affected":"Teams running İmzager versions from 2.10.5 before 2.10.7 are affected. The sources do not describe the data path, configuration or role needed to reach the flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["imzager","low","other"],"campaign_type":null,"first_public_at":"2026-11-04T09:17:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","cvss_by":"iletisim@usom.gov.tr","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-19721","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19721","severity":null,"published_at":"2026-11-04T09:17:42+00:00","modified_at":"2026-11-04T09:17:42+00:00","first_seen_at":"2026-11-04T09:26:09+00:00","fetched_at":"2026-11-04T09:26:09+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}