CVE-2026-93570
Description
A flaw was found in Szafir and Szafir Weryfikująca. This XML External Entity (XXE) injection flaw allows an attacker to achieve information disclosure by reading arbitrary files from the victim's system. To exploit this vulnerability, an attacker must persuade a user to sign or verify a specially crafted XML file containing external entity references, which the application's XML parser improperly processes.
Statement
This vulnerability is evaluated as having a Moderate impact because successful exploitation relies on explicit user interaction to process untrusted XML input and is restricted to local file read access without system compromise. Szafir and Szafir Weryfikująca are third-party electronic signature tools that are not packaged, shipped, or supported in Red Hat Enterprise Linux or any other Red Hat product offerings. Consequently, Red Hat environments remain unaffected unless users manually deploy and execute these third-party applications.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data; Read Files or Directories
If the attacker is able to include a crafted DTD and a default entity resolver is enabled, the attacker may be able to access arbitrary files on the system. By submitting an XML file that defines an external entity with a file:// URI, an attacker can cause the processing application to read the contents of a local file. For example, a URI such as "file:///c:/winnt/win.ini" designates (in Windows) the file C:\Winnt\win.ini, or file:///etc/passwd designates the password file in Unix-based systems. Once the content of the URI is read, it is fed back into the application that is processing the XML. This application may echo back the data (e.g., in an error message), thereby exposing the file contents.
Integrity
Technical Impact: Bypass Protection Mechanism
An attacker may supply a crafted DTD using URIs with schemes such as http://, forcing the application to make outgoing HTTP requests to servers that the attacker cannot reach directly, which can be used to bypass firewall restrictions; hide the source of attacks such as port scanning; or otherwise leverage the server's trust relationship with other entities.
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory)
The product could consume excessive CPU cycles or memory using a URI that points to a large file, or a device that always returns data such as /dev/random. Alternately, the URI could reference a file that contains many nested or recursive entity references to further slow down parsing.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
