Live › vulnerability › CVE-2026-93570
Szafir and Szafir Weryfikująca, Polish document signing applications, parse XML with external entities enabled. A crafted XML file with an external DTD reference lets an attacker read arbitrary files from the victim's filesystem when the user signs or verifies it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.
Users who sign or verify XML documents with Szafir or Szafir Weryfikująca are exposed when they open a crafted XML file. The sources do not say whether Szafir Weryfikująca's parser is configured differently from Szafir's, so treat both as affected until confirmed. Teams that do not use these applications can skip it.
No product ranges from the sources yet.
2.0 build 708Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Szafir and Szafir Weryfikująca are vulnerable to XML External Entity (XXE) injection. When a user signs or verify a crafted XML file containing a DOCTYPE with an external DTD reference, the parser processes external entities, allowing an attacker to read arbitrary files from the victim's filesystem.
This issue was fixed in Szafir version 2.0 build 708. Szafir Weryfikująca is no longer supported (End of Life) and has not been fixed.
This page as .md · .json · in your agent: get_signal("CVE-2026-93570")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.