Description

Szafir is vulnerable to Path Traversal in the uploaded filename. A man-in-the-middle attacker who can reroute update request to their server can prepare arbitrary XML file that will be saved in location chosen by attacker.  This issue was fixed in version 2.0 build 708.

Related CPE's

Could not find any relations

References

https://cert.pl/posts/2026/10/CVE-2026-93570

https://www.elektronicznypodpis.pl/

Weaknesses

[email protected]

Primary
CWE-22

CVSS impact metrics

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

2.3 · Low

Information

Source identifier

[email protected]

Vulnerability status

Deferred

Published

2026-10-29T16:20:05.893Z

14 hours ago

Last modified

2026-10-29T16:22:34.397Z

14 hours ago