Szafir: XML External Entity (XXE) injection
Summary
Szafir and Szafir Weryfikuj�
ca, Polish electronic signature applications from Krajowa Izba Rozliczeniowa, process external entities in XML files. When a user signs or verifies a crafted XML file with an external DTD reference, an attacker can read arbitrary files from the victim's system. Exploitation requires the victim to open the file, for example one received by email or download, and no network service is exposed.
Affected
- Szafir: all builds up to build 708 of version 2.0.0 (per CERT Polska)
- Szafir Weryfikuj�
ca: all versions (per CERT Polska; the CVE record lists versions up to 1.0)
Fixed in
- Szafir 2.0 build 708 or later
- Szafir Weryfikuj�
ca: not fixed, end of life, no fix planned
Workaround
- No vendor workaround documented.
- Do not open or verify XML files from untrusted sources.
Exploitation
- No exploitation known as of the latest sources.
- No public proof of concept indexed as of 29 Oct 2026 (OffSeq).
- Not listed in CISA KEV (OffSeq).
Our recommendation
- Inventory all Szafir installations and check the installed build number.
- Update Szafir 2.0 to build 708 or later.
- Remove Szafir Weryfikuj�
ca from sensitive workstations and replace it, as it will not be fixed.
- Avoid processing XML files from untrusted sources until patched.
- Monitor the CERT Polska advisory for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CERT Polska advisory cert.pl
- Vendor website (Szafir) www.elektronicznypodpis.pl
- VulDB vuldb.com
- OffSeq threat radar radar.offseq.com
- Strix CVE record mirror www.strix.ai
- ithardware.pl report ithardware.pl
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:41.
Original description (NVD)
Szafir and Szafir Weryfikująca are vulnerable to XML External Entity (XXE) injection. When a user signs or verify a crafted XML file containing a `DOCTYPE` with an external DTD reference, the parser processes external entities, allowing an attacker to read arbitrary files from the victim's filesystem. This issue was fixed in Szafir version 2.0 build 708. Szafir Weryfikująca is no longer supported (End of Life) and has not been fixed.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.