CVE-2026-93571 Details
Description
Szafir is vulnerable to Path Traversal in the uploaded filename. A man-in-the-middle attacker who can reroute update request to their server can prepare arbitrary XML file that will be saved in location chosen by attacker. This issue was fixed in version 2.0 build 708.
A path traversal vulnerability has been identified in the Szafir application by Krajowa Izba Rozliczeniowa. This issue affects all versions prior to 2.0 build 708. The vulnerability allows a man-in-the-middle attacker, who can intercept and redirect update requests, to create a malicious XML file that will be saved in a location of the attacker's choosing.
Users can update to Szafir version 2.0 build 708 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cert.pl/posts/2026/10/CVE-2026-93570 | [email protected] | AdvisoryBundleRemedy |
| https://www.elektronicznypodpis.pl/ | [email protected] | ProductVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Krajowa Izba Rozliczeniowa Szafir | <= 2.0.0 build 708 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | [email protected] |