Szafir e-signature software flaws disclosed
Polish KIR's Szafir signing software has XXE, path traversal, and certificate validation flaws letting attackers read files or deliver malicious updates.
Sourcecert.pl — open the original
What to check
- Applies to
- The 3 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of three vulnerabilities in Szafir and Szafir Weryfikująca, electronic signature software produced by Krajowa Izba Rozliczeniowa (KIR), the Polish clearing house. CVE-2026-93570 is an XML External Entity (XXE) injection affecting both Szafir and Szafir Weryfikująca: when a user signs or verifies a crafted XML file with a malicious DOCTYPE/external DTD reference, the parser processes external entities and can be abused to read arbitrary files from the victim's filesystem. Szafir has been patched in version 2.0 build 708, but Szafir Weryfikująca is end-of-life and will not receive a fix.
CVE-2026-93571 is a path traversal vulnerability in Szafir's handling of uploaded filenames; a man-in-the-middle attacker able to reroute the application's update request can place an arbitrary XML file at a location of their choosing on the victim's system. This is compounded by CVE-2026-106036, an improper certificate validation flaw in which Szafir accepts any client or server TLS certificate without validating it or the hostname, meaning an attacker who intercepts the connection can present any certificate and cause the application to fetch its 'update' from an attacker-controlled server. Chained together, the certificate-validation bypass enables the MITM positioning needed to exploit the path traversal and plant attacker-controlled files, including potentially malicious update packages.
All three issues were fixed in Szafir version 2.0 build 708; organizations using Szafir should update immediately. Szafir Weryfikująca users have no patch available and should discontinue use or isolate the software, as it remains permanently vulnerable to the XXE issue. There is no indication of in-the-wild exploitation; this is a coordinated disclosure following a report to CERT Polska by a researcher at Critical Security.
Mentioned in this report
Source reporting: https://cert.pl/en/posts/2026/10/CVE-2026-93570
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs