# Szafir e-signature software flaws disclosed

Published: 2026-10-29 · Severity: routine · Sectors: Financial Services, Government (National)
Canonical: https://vorant.io/reports/bf544d4c-ef54-5b05-8218-bffe15015bf0/szafir-e-signature-software-flaws-disclosed
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> Polish KIR's Szafir signing software has XXE, path traversal, and certificate validation flaws letting attackers read files or deliver malicious updates.

Source: cert.pl — https://cert.pl/en/posts/2026/10/CVE-2026-93570

## What to check

- Applies to: The 3 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

CERT Polska coordinated disclosure of three vulnerabilities in Szafir and Szafir Weryfikująca, electronic signature software produced by Krajowa Izba Rozliczeniowa (KIR), the Polish clearing house. CVE-2026-93570 is an XML External Entity (XXE) injection affecting both Szafir and Szafir Weryfikująca: when a user signs or verifies a crafted XML file with a malicious DOCTYPE/external DTD reference, the parser processes external entities and can be abused to read arbitrary files from the victim's filesystem. Szafir has been patched in version 2.0 build 708, but Szafir Weryfikująca is end-of-life and will not receive a fix.

CVE-2026-93571 is a path traversal vulnerability in Szafir's handling of uploaded filenames; a man-in-the-middle attacker able to reroute the application's update request can place an arbitrary XML file at a location of their choosing on the victim's system. This is compounded by CVE-2026-106036, an improper certificate validation flaw in which Szafir accepts any client or server TLS certificate without validating it or the hostname, meaning an attacker who intercepts the connection can present any certificate and cause the application to fetch its 'update' from an attacker-controlled server. Chained together, the certificate-validation bypass enables the MITM positioning needed to exploit the path traversal and plant attacker-controlled files, including potentially malicious update packages.

All three issues were fixed in Szafir version 2.0 build 708; organizations using Szafir should update immediately. Szafir Weryfikująca users have no patch available and should discontinue use or isolate the software, as it remains permanently vulnerable to the XXE issue. There is no indication of in-the-wild exploitation; this is a coordinated disclosure following a report to CERT Polska by a researcher at Critical Security.

## Mentioned in this report

- Vulnerabilities: CVE-2026-106036, CVE-2026-93570, CVE-2026-93571

Source reporting: https://cert.pl/en/posts/2026/10/CVE-2026-93570

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/bf544d4c-ef54-5b05-8218-bffe15015bf0/szafir-e-signature-software-flaws-disclosed.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup