# Szafir software vulnerabilities: XXE (CVE-2026-93570), path traversal (CVE-2026-93571), improper certificate validation (CVE-2026-106036)

> CERT Polska disclosed three vulnerabilities in Szafir, the electronic-signature application from Krajowa Izba Rozliczeniowa (KIR): an XXE flaw allowing arbitrary local file read when a crafted XML file is signed or verified, a path traversal in the update handling, and a complete lack of certificate and hostname validation. Szafir is fixed in 2.0 build 708; Szafir Weryfikująca (all versions) is End of Life and remains unpatched.

- **Published:** 2026-10-30T01:30:48Z
- **Last reviewed:** 2026-10-30T01:30:48Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4788
- **ID:** TL-2026-4788
- **Severity:** HIGH (CVSS 8.2)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-93570, CVE-2026-93571, CVE-2026-106036, CVE-2026-9058

## Description

CERT Polska published coordinated-disclosure advisory CVE-2026-93570 on 29 October 2026 covering three vulnerabilities in Szafir, a digital signature application developed by Krajowa Izba Rozliczeniowa S.A. (KIR). Szafir versions below 2.0.0 build 708 are affected, as are all versions of the companion product Szafir Weryfikująca. The issues were reported by Mikus Teivens of Critical Security.

CVE-2026-93570 (CWE-611, XML External Entity injection): when a user signs or verifies a crafted XML file containing a DOCTYPE declaration with an external DTD reference, the XML parser resolves external entities. This allows an attacker who can get the victim to open the file to read arbitrary files from the victim's filesystem. User interaction is required (open/sign/verify a malicious XML document). NVD scores this CVE 8.2 (HIGH) under CVSS 4.0 (AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N). It is fixed in Szafir 2.0 build 708; Szafir Weryfikująca will not be fixed because it is End of Life.

CVE-2026-93571 (CWE-22, path traversal): a man-in-the-middle attacker who can redirect Szafir's update requests can supply crafted XML files that are saved to attacker-chosen locations on the victim system. Fixed in Szafir 2.0 build 708.

CVE-2026-106036 (CWE-295, improper certificate validation): the application accepts any client or server certificate without performing certificate and hostname validation. An attacker able to intercept traffic can present a forged SSL/TLS certificate and deliver malicious updates. Fixed in Szafir 2.0 build 708. Combined with the path traversal, the update channel is attackable by a network-positioned adversary; CERT Polska describes malicious update delivery as the consequence.

The advisory reports no confirmed in-the-wild exploitation, no public proof-of-concept, and no indicators of compromise. CVSS scores for CVE-2026-93571 and CVE-2026-106036 were not published in the sources reviewed. Earlier, separate CERT Polska advisory CVE-2026-9058 (May 2026) covered a different improper certificate validation flaw in the Szafir SDK (fixed in 1.8.463.2); it is a distinct issue, noted here only as related product history.

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1204.002 Malicious File
- T1557 Adversary-in-the-Middle
- T1005 Data from Local System
- T1565.001 Stored Data Manipulation

## Sources

- [CERT Polska - Vulnerabilities in Szafir software](https://cert.pl/en/posts/2026/10/CVE-2026-93570/)
- [NVD - CVE-2026-93570](https://nvd.nist.gov/vuln/detail/CVE-2026-93570)
- [CERT Polska - CVE-2026-9058 (related Szafir SDK certificate validation flaw)](https://cert.pl/posts/2026/05/CVE-2026-9058/)
- [CVE Record - CVE-2026-9058](https://www.cve.org/CVERecord?id=CVE-2026-9058)
- [CERT Polska Coordinated Vulnerability Disclosure policy](https://cert.pl/en/cvd/)
- [CERT Polska incident reporting portal](https://incydent.cert.pl/#!/lang=en)
- [Szafir vendor site (elektronicznypodpis.pl)](https://www.elektronicznypodpis.pl/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4788