Threat reportVulnerabilityTL-2026-4788
Szafir software vulnerabilities: XXE (CVE-2026-93570), path traversal (CVE-2026-93571), improper certificate validation (CVE-2026-106036)
Szafir software vulnerabilities (TL-2026-4788) is a high-severity software vulnerability scored CVSS 8.2, first published 2026-10-30. It has no confirmed attribution, affects Krajowa Izba Rozliczeniowa Szafir, references 4 CVEs (CVE-2026-93570, CVE-2026-93571, CVE-2026-106036), maps to 5 MITRE ATT&CK techniques (T1005, T1195.002, T1204.002), and is covered by 9 detection rules and 8 indicators of compromise.
- CVSS
- 8.2/10High
- CVEs
- 4Referenced vulnerabilities
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-4788
- Threat ID
- TL-2026-4788
- Severity
- HIGH
- CVSS
- 8.2 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N)
- Status
- MONITORING
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- electronic-signature users
- Target regions
- poland
- Detection rules
- 9
- Indicators of compromise
- 8
Malware and tooling in Szafir software vulnerabilities
Malware and tooling: Szafir, Szafir Weryfikująca
How Szafir software vulnerabilities works
CERT Polska disclosed three vulnerabilities in Szafir, the electronic-signature application from Krajowa Izba Rozliczeniowa (KIR): an XXE flaw allowing arbitrary local file read when a crafted XML file is signed or verified, a path traversal in the update handling, and a complete lack of certificate and hostname validation. Szafir is fixed in 2.0 build 708; Szafir Weryfikująca (all versions) is End of Life and remains unpatched.
CERT Polska published coordinated-disclosure advisory CVE-2026-93570 on 29 October 2026 covering three vulnerabilities in Szafir, a digital signature application developed by Krajowa Izba Rozliczeniowa S.A. (KIR). Szafir versions below 2.0.0 build 708 are affected, as are all versions of the companion product Szafir Weryfikująca. The issues were reported by Mikus Teivens of Critical Security.
CVE-2026-93570 (CWE-611, XML External Entity injection): when a user signs or verifies a crafted XML file containing a DOCTYPE declaration with an external DTD reference, the XML parser resolves external entities. This allows an attacker who can get the victim to open the file to read arbitrary files from the victim's filesystem. User interaction is required (open/sign/verify a malicious XML document). NVD scores this CVE 8.2 (HIGH) under CVSS 4.0 (AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N). It is fixed in Szafir 2.0 build 708; Szafir Weryfikująca will not be fixed because it is End of Life.
CVE-2026-93571 (CWE-22, path traversal): a man-in-the-middle attacker who can redirect Szafir's update requests can supply crafted XML files that are saved to attacker-chosen locations on the victim system. Fixed in Szafir 2.0 build 708.
CVE-2026-106036 (CWE-295, improper certificate validation): the application accepts any client or server certificate without performing certificate and hostname validation. An attacker able to intercept traffic can present a forged SSL/TLS certificate and deliver malicious updates. Fixed in Szafir 2.0 build 708. Combined with the path traversal, the update channel is attackable by a network-positioned adversary; CERT Polska describes malicious update delivery as the consequence.
The advisory reports no confirmed in-the-wild exploitation, no public proof-of-concept, and no indicators of compromise. CVSS scores for CVE-2026-93571 and CVE-2026-106036 were not published in the sources reviewed. Earlier, separate CERT Polska advisory CVE-2026-9058 (May 2026) covered a different improper certificate validation flaw in the Szafir SDK (fixed in 1.8.463.2); it is a distinct issue, noted here only as related product history.
MITRE ATT&CK techniques used in TL-2026-4788
Collection
Initial Access
T1195.002 Compromise Software Supply Chain
Execution
Credential Access
Impact
Affected products and versions in Szafir software vulnerabilities
- Krajowa Izba Rozliczeniowa — Szafir
Vulnerable versions: all versions below 2.0.0 build 708
Fixed in: 2.0 build 708 - Krajowa Izba Rozliczeniowa — Szafir Weryfikująca
Vulnerable versions: all versions (CVE-2026-93570; End of Life)
Remediation for Szafir software vulnerabilities
Patches
- Szafir 2.0 build 708 fixes CVE-2026-93570, CVE-2026-93571 and CVE-2026-106036
Immediate actions
- Upgrade Szafir to version 2.0 build 708 or later
- Do not sign or verify XML files received from untrusted sources until patched
- Stop using Szafir Weryfikująca (End of Life, no fix will be released) and migrate to a supported product
Workarounds
- No fix exists for Szafir Weryfikująca; remove it from use
- Avoid running Szafir updates over untrusted or intercepted networks (certificate validation is absent in unpatched versions)
Longer-term hardening
- Inventory endpoints running Szafir or Szafir Weryfikująca and track removal of unsupported versions
- Monitor for outbound connections initiated by Szafir processes to unexpected hosts (external DTD fetches, update traffic)
CVEs associated with Szafir software vulnerabilities
CVE-2026-93570, CVE-2026-93571, CVE-2026-106036, CVE-2026-9058
Weaknesses (CWE) in Szafir software vulnerabilities
Timeline of Szafir software vulnerabilities
- Related, separate Szafir SDK certificate validation flaw CVE-2026-9058 reported to CERT Polska (fixed in Szafir SDK 1.8.463.2)
- CERT Polska updated the CVE-2026-9058 Szafir SDK advisory with an additional CWE
- NVD published CVE-2026-93570 with CVSS 4.0 base score 8.2 (HIGH)
- Szafir Weryfikująca (all versions) confirmed End of Life and not fixed for CVE-2026-93570
- Szafir 2.0 build 708 released as the fixed version for all three vulnerabilities
- CERT Polska published advisory for CVE-2026-93570, CVE-2026-93571 and CVE-2026-106036 in Szafir, crediting Mikus Teivens (Critical Security)
Sources cited for Szafir software vulnerabilities
- CERT Polska - Vulnerabilities in Szafir software
- NVD - CVE-2026-93570
- CERT Polska - CVE-2026-9058 (related Szafir SDK certificate validation flaw)
- CVE Record - CVE-2026-9058
- CERT Polska Coordinated Vulnerability Disclosure policy
- CERT Polska incident reporting portal
- Szafir vendor site (elektronicznypodpis.pl)
Detection coverage for TL-2026-4788
As of 2026-10-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4788 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.