{"id":"CVE-2026-93571","kind":"vulnerability","aliases":["CVE-2026-93571"],"related":[],"title":"Szafir: path traversal lets an update server write files anywhere","description":"Szafir is vulnerable to Path Traversal in the uploaded filename. A man-in-the-middle attacker who can reroute update request to their server can prepare arbitrary XML file that will be saved in location chosen by attacker. \n\n\nThis issue was fixed in version 2.0 build 708.","summary":"Szafir, a Polish electronic-signature application, does not check the uploaded filename during updates. A man-in-the-middle attacker who redirects the update request can deliver an XML file that is saved to a location of their choosing.","severity":"low","cvss":2.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","package","szafir","windows"],"not_affected_if":["fixed-version","trusted-network"],"how_to_check":"- Check the installed Szafir version in the application's About dialog or package metadata against the fixed release.","fix":"- Upgrade Szafir to `2.0` build `708` or later.","status":"open","published_at":"2026-10-29T16:20:05+00:00","first_seen_at":"2026-10-29T16:26:03+00:00","triaged_at":"2026-10-29T16:32:12+00:00","updated_at":"2026-10-29T16:32:12+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T16:32:12Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Szafir to `2.0` build `708` or later.","reach":"network","title":"Szafir: path traversal lets an update server write files anywhere","impact":"medium","summary":"Szafir, a Polish electronic-signature application, does not check the uploaded filename during updates. A man-in-the-middle attacker who redirects the update request can deliver an XML file that is saved to a location of their choosing.","audience":"businesses","category":"package","nicknames":[],"who_cares":["szafir","windows","desktop"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"attacker writes an XML file to a chosen path on the machine","analyst_note":"","how_to_check":"- Check the installed Szafir version in the application's About dialog or package metadata against the fixed release.\n- unknown","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-version","trusted-network"],"who_is_affected":"Machines running Szafir older than 2.0 build 708 are exposed when update traffic can be redirected, for example on an untrusted network. The sources do not describe the exact deployment pattern beyond that update path, so the scope beyond it is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000637,"input_tokens":4107,"output_tokens":452,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-93571':13A,16A '2.0':107C '708':109C 'anywher':10A 'applic':27B 'arbitrari':89C 'attack':42B,78C,100C 'build':108C 'check':30B 'choos':61B 'chosen':98C 'cve':11A,14A 'deliv':49B 'desktop':17B 'electron':25B 'electronic-signatur':24B 'file':9A,52B,91C 'filenam':33B,71C 'fix':104C 'issu':102C 'let':4A 'locat':58B,97C 'man':38B,74C 'man-in-the-middl':37B,73C 'middl':41B,77C 'packag':18B 'path':2A,66C 'polish':23B 'prepar':88C 'redirect':44B 'request':47B,83C 'rerout':81C 'save':55B,95C 'server':7A,86C 'signatur':26B 'szafir':1A,19B,21B,62C 'travers':3A,67C 'updat':6A,35B,46B,82C 'upload':32B,70C 'version':106C 'vulner':64C 'window':20B 'write':8A 'xml':51B,90C","nicknames":[],"mitigations":[],"who_affected":"Machines running Szafir older than 2.0 build 708 are exposed when update traffic can be redirected, for example on an untrusted network. The sources do not describe the exact deployment pattern beyond that update path, so the scope beyond it is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:20:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cvd@cert.pl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93571","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93571","severity":null,"published_at":"2026-10-29T16:20:05+00:00","modified_at":"2026-10-29T16:22:34+00:00","first_seen_at":"2026-10-29T16:26:03+00:00","fetched_at":"2026-10-29T16:26:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}