# CVE-2026-25827: Keyfactor SignServer local file enumeration via unrestricted properties

Source: https://junglewise.ai/threats/cve-2026-25827-keyfactor-signserver-local-file-enumeration-via-unrestricted  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-25827 · Severity: low · CVSS 2.3 · Published 2026-09-15

Keyfactor SignServer is a PKI/code-signing solution used by enterprises to manage digital certificates and cryptographic operations. An administrative user can misconfigure three file path properties (ATTRIBUTESFILE, KEYSTOREPATH, TRUSTSTOREPATH) to probe the server's filesystem and determine whether specific files exist, potentially exposing sensitive information about the system configuration and file structure to clients.

Technologies: [Keyfactor SignServer](https://junglewise.ai/threats/technologies/signserver). Vendors: [Keyfactor](https://junglewise.ai/threats/vendors/keyfactor).

## Quick answers

**Is CVE-2026-25827 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25827 being exploited in the wild.

**How severe is CVE-2026-25827?** Low severity, with a CVSS score of 2.3, published 15 September 2026.

**Which products and versions are affected?** Keyfactor SignServer before 7.6.0.

**Is there a fix for CVE-2026-25827?** A patch was published on 2026: Fixed in SignServer 7.6.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-25827 attacked?** It is attacked with local access, in a hosted service.

**Am I affected by CVE-2026-25827?** Check whether you run Keyfactor SignServer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a local file enumeration flaw affecting three properties in SignServer's cryptographic token implementations: ATTRIBUTESFILE in PKCS11CryptoToken, KEYSTOREPATH in KeyStoreCryptoToken, and TRUSTSTOREPATH in RenewalWorker. The root cause is insufficient input validation on file path properties, allowing an authenticated admin to set these paths without restrictions. When a misconfigured path is used, the application returns error messages that confirm file existence or non-existence, enabling an attacker with admin privileges to enumerate the filesystem. This requires administrative access to the application and does not directly compromise cryptographic keys or sign operations. The vulnerability was patched in SignServer 7.6.0.

## Affected products

- Keyfactor SignServer before 7.6.0

## Timeline

- 2026-09-15: disclosed
- 2026: patched: Fixed in SignServer 7.6.0

## References

- [https://keyfactor.com/](https://keyfactor.com/)
- [https://support.keyfactor.com/hc/en-us/articles/46345356843291-SignServer-CVE-2026-25827-Local-File-Enumeration](https://support.keyfactor.com/hc/en-us/articles/46345356843291-SignServer-CVE-2026-25827-Local-File-Enumeration)

## Related threats

- [Keyfactor SignServer file content exposure in PKCS11CryptoToken](https://junglewise.ai/threats/cve-2026-25826-keyfactor-signserver-file-content-exposure-in-pkcs11cryptotoken)
- [Keyfactor SignServer arbitrary file write in SignerStatusReportWorker](https://junglewise.ai/threats/cve-2026-25825-keyfactor-signserver-arbitrary-file-write-in)
- [An error in the SignServer container startup logic was found in Keyfactor SignServer versions prior to 7.2. The Admin…](https://junglewise.ai/threats/cve-2025-26787-an-error-in-the-signserver-container-startup-logic-was-found-in)
- [A class name enumeration was found in Keyfactor SignServer versions prior to 7.3.2. Setting any chosen class name to…](https://junglewise.ai/threats/cve-2025-47222-a-class-name-enumeration-was-found-in-keyfactor-signserver)
- [An arbitrary file write was found in Keyfactor SignServer versions prior to 7.3.2. The properties…](https://junglewise.ai/threats/cve-2025-47221-an-arbitrary-file-write-was-found-in-keyfactor-signserver)