CVE-2026-112198 Details
Description
XML External Entity (XXE) injection vulnerability in the SAFT import feature of the NoviGest Desktop App. The application processes user-controlled XML files using a JAXB Unmarshaller without properly disabling external entity resolution. An attacker with access to this functionality could provide a manipulated XML file to read local files accessible to the application process. If the application runs with elevated privileges, sensitive system files could be exposed.
A vulnerability allowing XML External Entity (XXE) injection has been identified in the SAFT import feature of the NoviGest Desktop App, version 7.4.4-292. This vulnerability arises because the application processes user-controlled XML files with a JAXB Unmarshaller without properly disabling external entity resolution. An attacker could exploit this flaw by providing a manipulated XML file to read local files accessible to the application process. If the application is running with elevated privileges, sensitive system files could be exposed.
Users are advised to update the NoviGest Desktop App to version 8.0.0-300, in which the vendor has confirmed that this vulnerability has been fixed. In the updated version, XML processing has been revised to use an XMLStreamReader with DTDs and external entities disabled, and schema validation now employs secure processing that blocks access to external DTDs and schemas.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tactis-novigest-desktop-app | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-611 | Improper Restriction of XML External Entity Reference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Tactis NoviGest Desktop App | 7.4.4-292 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | New CVE Received | [email protected] |