# CVE-2026-93570: Szafir XML External Entity injection in XML signing

Source: https://junglewise.ai/threats/cve-2026-93570-szafir-and-szafir-weryfikujaca-are-vulnerable-to-xml-external  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-93570 · Severity: info · Published 2026-10-29

Szafir is an electronic signature and digital certificate application used to sign and verify documents in Poland. When a user signs or verifies a crafted XML file, an attacker can read arbitrary files from the user's computer by embedding malicious external entity references in the document. No public exploitation has been reported.

Technologies: [Krajowa Izba Rozliczeniowa Szafir](https://junglewise.ai/threats/technologies/szafir). Vendors: [Krajowa Izba Rozliczeniowa](https://junglewise.ai/threats/vendors/krajowa-izba-rozliczeniowa).

## Quick answers

**Is CVE-2026-93570 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93570 being exploited in the wild.

**How severe is CVE-2026-93570?** Informational severity, published 29 October 2026.

**Which products and versions are affected?** Krajowa Izba Rozliczeniowa Szafir all versions up to 2.0 build 707; Krajowa Izba Rozliczeniowa Szafir Weryfikująca all versions.

**Is there a fix for CVE-2026-93570?** Yes: fixed in Szafir 2.0 build 708. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-93570 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-93570?** Check whether you run Krajowa Izba Rozliczeniowa Szafir or Krajowa Izba Rozliczeniowa Szafir Weryfikująca at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Szafir 2.0 build 708

## Technical details

The vulnerability is an XML External Entity (XXE) injection in the XML parser used by Szafir and Szafir Weryfikująca. When processing a crafted XML file with a DOCTYPE containing external DTD references during signing or verification operations, the parser processes external entities without proper restrictions, allowing file disclosure. Szafir was patched in version 2.0 build 708; Szafir Weryfikująca is end-of-life and remains unpatched.

## Affected products

- Krajowa Izba Rozliczeniowa Szafir all versions up to 2.0 build 707
- Krajowa Izba Rozliczeniowa Szafir Weryfikująca all versions

## Timeline

- 2026-10-29: disclosed

## References

- [https://cert.pl/posts/2026/10/CVE-2026-93570](https://cert.pl/posts/2026/10/CVE-2026-93570)
- [https://www.elektronicznypodpis.pl/](https://www.elektronicznypodpis.pl/)

## Related threats

- [Szafir path traversal in update filename handling](https://junglewise.ai/threats/cve-2026-93571-szafir-is-vulnerable-to-path-traversal-in-the-uploaded-filename-a)
- [Szafir improper certificate validation in HTTPS connections](https://junglewise.ai/threats/cve-2026-106036-szafir-accepts-any-client-or-server-certificate-without)