---
id: "CVE-2026-19721"
kind: "vulnerability"
aliases: ["CVE-2026-19721"]
title: "\u0130mzager: XML external entity flaw lets attackers read linked data"
severity: "low"
cvss: 3.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["imzager", "other"]
not_affected_if: ["version-outside-range"]
published_at: "2026-11-04T09:17:42+00:00"
first_seen_at: "2026-11-04T09:26:09+00:00"
updated_at: "2026-11-04T09:26:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19721", "first_seen_at": "2026-11-04T09:26:09+00:00"}]
---

# İmzager: XML external entity flaw lets attackers read linked data

İmzager, an electronic signature application from TÜBİTAK BİLGEM, does not restrict XML external entity references in some data it processes. The sources do not say what an attacker can read or whether it can be triggered remotely.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed İmzager version and see whether it is in the range `2.10.5` to before `2.10.7`

## Fix

- İmzager: move to `2.10.7` or later

## Timeline

- 2026-11-04T09:26:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-19721

## From the sources

Improper restriction of XML external entity reference vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute İmzager allows Serialized Data External Linking.

This issue affects İmzager: from 2.10.5 before 2.10.7.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_