---
id: "CVE-2026-93571"
kind: "vulnerability"
aliases: ["CVE-2026-93571"]
title: "Szafir: path traversal lets an update server write files anywhere"
severity: "low"
cvss: 2.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["desktop", "package", "szafir", "windows"]
not_affected_if: ["fixed-version", "trusted-network"]
published_at: "2026-10-29T16:20:05+00:00"
first_seen_at: "2026-10-29T16:26:03+00:00"
updated_at: "2026-10-29T16:32:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93571", "first_seen_at": "2026-10-29T16:26:03+00:00"}]
---

# Szafir: path traversal lets an update server write files anywhere

Szafir, a Polish electronic-signature application, does not check the uploaded filename during updates. A man-in-the-middle attacker who redirects the update request can deliver an XML file that is saved to a location of their choosing.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Szafir version in the application's About dialog or package metadata against the fixed release.

## Fix

- Upgrade Szafir to `2.0` build `708` or later.

## Timeline

- 2026-10-29T16:26:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-93571

## From the sources

Szafir is vulnerable to Path Traversal in the uploaded filename. A man-in-the-middle attacker who can reroute update request to their server can prepare arbitrary XML file that will be saved in location chosen by attacker. 


This issue was fixed in version 2.0 build 708.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_