Tactis NoviGest Desktop App: XML External Entity injection in SAFT import
Summary
The SAFT import feature of the NoviGest Desktop App, a clinical management software, processes user-supplied XML files with a JAXB Unmarshaller that does not properly disable external entity resolution. An attacker with access to the import function, which requires a low-privileged local account, can supply a manipulated XML file to read local files accessible to the application process. If the application runs with elevated privileges, sensitive system files could be exposed. The vendor's fix is included in the same upgrade that addresses the critical CVE-2026-112197.
Affected
- NoviGest Desktop App prior to 8.0.0-300 (CNA record)
- INCIBE-2026-801 reports on version 7.4.4-292
Fixed in
- Version 8.0.0-300 (vendor confirms the fix)
Workaround
- Unknown. No vendor workaround found.
- Interim: restrict who can use the SAFT import, do not import files from untrusted sources, and run the application with the lowest practical account privileges.
Exploitation
- Not known to be exploited at the time of the sources.
- No public proof of concept or CISA KEV listing found.
Our recommendation
- Inventory NoviGest Desktop App installations.
- Upgrade to 8.0.0-300 or later, prioritising hosts where the application runs with elevated privileges.
- Confirm the upgrade also covers CVE-2026-112197, which is more serious.
- Restrict SAFT import to trusted users and files until patched.
- Assess whether the local file read could affect personal health data under Swiss data protection law.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- INCIBE-CERT notice INCIBE-2026-801 www.incibe.es
- Bujarra security notice (CVSS vector and fix details) www.bujarra.com
- OffSeq Radar: CVE-2026-112198 radar.offseq.com
- Strix AI: CVE-2026-112198 www.strix.ai
- Strix AI: CVE-2026-112197 www.strix.ai
- TechConsulting: INCIBE notice summary (Spanish) techconsulting.es
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:08.
Original description (NVD)
XML External Entity (XXE) injection vulnerability in the SAFT import feature of the NoviGest Desktop App. The application processes user-controlled XML files using a JAXB Unmarshaller without properly disabling external entity resolution. An attacker with access to this functionality could provide a manipulated XML file to read local files accessible to the application process. If the application runs with elevated privileges, sensitive system files could be exposed.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.