{"id":"CVE-2026-93570","kind":"vulnerability","aliases":["CVE-2026-93570"],"related":[],"title":"Szafir signing software: crafted XML file reads local files","description":"Szafir and Szafir Weryfikująca are vulnerable to XML External Entity (XXE) injection. When a user signs or verify a crafted XML file containing a `DOCTYPE` with an external DTD reference, the parser processes external entities, allowing an attacker to read arbitrary files from the victim's filesystem.\n\n\nThis issue was fixed in Szafir version 2.0 build 708. Szafir Weryfikująca is no longer supported (End of Life) and has not been fixed.","summary":"Szafir and Szafir Weryfikująca, Polish document signing applications, parse XML with external entities enabled. A crafted XML file with an external DTD reference lets an attacker read arbitrary files from the victim's filesystem when the user signs or verifies it.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","szafir","windows","xml"],"not_affected_if":["not-installed"],"how_to_check":"- Open Szafir and check the installed version against the fixed build named in the sources.\n- Check whether Szafir Weryfikująca is installed; the sources say it is end of life and was not fixed.","fix":"- Szafir: `2.0 build 708`\n- Szafir Weryfikująca: unknown, the sources say it is no longer supported and has not been fixed","status":"open","published_at":"2026-10-29T16:20:05+00:00","first_seen_at":"2026-10-29T16:26:03+00:00","triaged_at":"2026-10-29T16:29:34+00:00","updated_at":"2026-10-29T16:29:34+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-29T16:29:34Z","model":"claude-haiku-5-5","output":{"fix":"- Szafir: `2.0 build 708`\n- Szafir Weryfikująca: unknown, the sources say it is no longer supported and has not been fixed","reach":"local","title":"Szafir signing software: crafted XML file reads local files","impact":"high","summary":"Szafir and Szafir Weryfikująca, Polish document signing applications, parse XML with external entities enabled. A crafted XML file with an external DTD reference lets an attacker read arbitrary files from the victim's filesystem when the user signs or verifies it.","audience":"everyone","category":"other","nicknames":[],"who_cares":["szafir","xml","windows"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"local files readable by the attacker from the victim's machine","analyst_note":"Confirm which platforms and document types are affected, and whether Szafir Weryfikująca has any mitigation short of removal; see https://nvd.nist.gov/vuln/detail/CVE-2026-93570.","how_to_check":"- Open Szafir and check the installed version against the fixed build named in the sources.\n- Check whether Szafir Weryfikująca is installed; the sources say it is end of life and was not fixed.","plain_action":"Update Szafir to version 2.0 build 708 or newer, and stop using Szafir Weryfikująca, which the vendor no longer supports.","needs_analyst":true,"not_affected_if":["not-installed"],"who_is_affected":"Users who sign or verify XML documents with Szafir or Szafir Weryfikująca are exposed when they open a crafted XML file. The sources do not say whether Szafir Weryfikująca's parser is configured differently from Szafir's, so treat both as affected until confirmed. Teams that do not use these applications can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000745,"input_tokens":4184,"output_tokens":653,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-93570':12A,15A '2.0':114C '708':116C 'allow':95C 'applic':27B 'arbitrari':47B,100C 'attack':45B,97C 'build':115C 'contain':82C 'craft':4A,35B,79C 'cve':10A,13A 'doctyp':84C 'document':25B 'dtd':41B,88C 'enabl':33B 'end':123C 'entiti':32B,69C,94C 'extern':31B,40B,68C,87C,93C 'file':6A,9A,37B,48B,81C,101C 'filesystem':53B,106C 'fix':110C,130C 'inject':71C 'issu':108C 'let':43B 'life':125C 'local':8A 'longer':121C 'pars':28B 'parser':91C 'polish':24B 'process':92C 'read':7A,46B,99C 'refer':42B,89C 'sign':2A,26B,57B,75C 'softwar':3A 'support':122C 'szafir':1A,17B,20B,22B,60C,62C,112C,117C 'user':56B,74C 'verifi':59B,77C 'version':113C 'victim':51B,104C 'vulner':65C 'weryfikująca':23B,63C,118C 'window':18B 'xml':5A,19B,29B,36B,67C,80C 'xxe':70C","nicknames":[],"mitigations":[],"who_affected":"Users who sign or verify XML documents with Szafir or Szafir Weryfikująca are exposed when they open a crafted XML file. The sources do not say whether Szafir Weryfikująca's parser is configured differently from Szafir's, so treat both as affected until confirmed. Teams that do not use these applications can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Szafir to version 2.0 build 708 or newer, and stop using Szafir Weryfikująca, which the vendor no longer supports.","first_public_at":"2026-10-29T16:20:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cvd@cert.pl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93570","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93570","severity":null,"published_at":"2026-10-29T16:20:05+00:00","modified_at":"2026-10-29T16:22:34+00:00","first_seen_at":"2026-10-29T16:26:03+00:00","fetched_at":"2026-10-29T16:26:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}