SzafirHost JAR signature check bypass patched

A flaw in SzafirHost's JAR verification let attackers smuggle malicious classes past signature checks to achieve remote code execution, now fixed in v1.2.1.

CERT Polska coordinated disclosure of CVE-2026-44088, a signature-verification bypass in SzafirHost. The software validates JAR file signatures using JarInputStream, which reads from the start of the file, but actually loads classes via JarFile/URLClassLoader, which reads the Central Directory from the end of the ZIP structure. This discrepancy allows an attacker to craft a hybrid archive combining a legitimately signed JAR with an appended malicious ZIP, so the signature check passes while the malicious class is the one actually executed.

Exploitation of this flaw could result in remote code execution on systems using vulnerable versions of SzafirHost. The issue was responsibly reported by researcher Mariusz Maik and has been resolved in version 1.2.1. No indication of active in-the-wild exploitation is provided in the advisory; this is a coordinated disclosure with a patch already available, so organizations running SzafirHost should prioritize updating to the fixed release.

Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-44088