{"id":"EM-20261029-P1AN","url":"https://cyber.eventmonitor.net/incident/EM-20261029-P1AN/","type":"cve","title":"Szafir Vulnerability (CVE-2026-93570)","subtitle":"CVE-2026-93570","subject":"CVE-2026-93570","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-10-29T16:20:05.730Z","firstSignal":"2026-10-29T10:55:00.000Z","lastSignal":"2026-10-29T16:20:05.730Z","updated":"2026-11-04T14:43:58.877Z","revision":1,"life":[{"status":"Born","at":"2026-10-29T16:20:05.730Z","why":"second independent source: C6 NVD CVE API 2.0"},{"status":"Developing","at":"2026-10-29T16:20:05.730Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-10-29T10:55:00.000Z","what":"First signal: C17 CERT Polska"},{"at":"2026-10-29T16:20:05.730Z","what":"Born: second source, C6 NVD CVE API 2.0. Page EM-20261029-P1AN created."},{"at":"2026-10-29T16:20:05.730Z","what":"Severity raised to High by C6"}],"stages":[{"name":"Disclosed","at":"2026-10-29T16:20:05.730Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-10-29T16:20:05.730Z","detail":"CVSS 8.2 · EPSS 0.3%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":"2026-10-29T10:55:00.000Z","detail":"1 government and CERT sources"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-10-29T10:55:00.000Z","source":"C17","sourceName":"CERT Polska","role":"Government","severity":2,"title":"Vulnerabilities in Szafir software","text":"CERT Polska has received a report about 3 vulnerabilities (CVE-2026-93570, CVE-2026-93571 and CVE-2026-106036) found in Szafir software.","url":"https://cert.pl/en/posts/2026/10/CVE-2026-93570/"},{"at":"2026-10-29T16:20:05.730Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-93570 (CVSS 8.2)","text":"Szafir and Szafir Weryfikująca are vulnerable to XML External Entity (XXE) injection. When a user signs or verify a crafted XML file containing a `DOCTYPE` with an external DTD reference, the parser processes external entities, allowing an attacker to read arbitrary files from the victim's filesystem.\n\n\nThis issue was fixed in Szafir version 2.0 build 708. Szafir Weryfikująca is no longer supported (End of Life) and has not been fixed.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93570"}],"crowd":[],"reference":{"nvd":{"published":"2026-10-29T16:20:05.730","score":8.2,"severity":"HIGH","desc":"Szafir and Szafir Weryfikująca are vulnerable to XML External Entity (XXE) injection. When a user signs or verify a crafted XML file containing a `DOCTYPE` with an external DTD reference, the parser processes external entities, allowing an attacker to read arbitrary files from the victim's filesyste","product":"","seen":1793803438877},"kev":null,"epss":{"epss":0.00278,"pct":0.20402,"at":1793803438877},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}