---
id: "CVE-2026-93570"
kind: "vulnerability"
aliases: ["CVE-2026-93570"]
title: "Szafir signing software: crafted XML file reads local files"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "szafir", "windows", "xml"]
not_affected_if: ["not-installed"]
published_at: "2026-10-29T16:20:05+00:00"
first_seen_at: "2026-10-29T16:26:03+00:00"
updated_at: "2026-10-29T16:29:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93570", "first_seen_at": "2026-10-29T16:26:03+00:00"}]
---

# Szafir signing software: crafted XML file reads local files

Szafir and Szafir Weryfikująca, Polish document signing applications, parse XML with external entities enabled. A crafted XML file with an external DTD reference lets an attacker read arbitrary files from the victim's filesystem when the user signs or verifies it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Open Szafir and check the installed version against the fixed build named in the sources.
- Check whether Szafir Weryfikująca is installed; the sources say it is end of life and was not fixed.

## Fix

- Szafir: `2.0 build 708`
- Szafir Weryfikująca: unknown, the sources say it is no longer supported and has not been fixed

## Timeline

- 2026-10-29T16:26:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-93570

## From the sources

Szafir and Szafir Weryfikująca are vulnerable to XML External Entity (XXE) injection. When a user signs or verify a crafted XML file containing a `DOCTYPE` with an external DTD reference, the parser processes external entities, allowing an attacker to read arbitrary files from the victim's filesystem.


This issue was fixed in Szafir version 2.0 build 708. Szafir Weryfikująca is no longer supported (End of Life) and has not been fixed.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_