CVE-2026-44088 Details

A remote code execution vulnerability exists in SzafirHost versions prior to 1.2.1. The issue arises because SzafirHost verifies the signature of downloaded JAR files using JarInputStream, which reads from the beginning of the file. However, it loads classes using JarFile and URLClassLoader, which read the Central Directory from the end of the file. This discrepancy allows an attacker to combine a legitimate, signed JAR file with a malicious ZIP file, bypassing signature verification and leading to the execution of malicious code.

Users can upgrade to SzafirHost version 1.2.1 or later to address this vulnerability.