Is CVE-2026-93571 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-93571 being exploited in the wild.

How severe is CVE-2026-93571?

Informational severity, published 29 October 2026.

Which products and versions are affected?

Krajowa Izba Rozliczeniowa Szafir all versions up to build 708 of version 2.0.0.

Is there a fix for CVE-2026-93571?

Yes: fixed in Szafir 2.0 build 708. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-93571 attacked?

It is attacked over the network or from the adjacent network, in a software library.

Am I affected by CVE-2026-93571?

Check whether you run Krajowa Izba Rozliczeniowa Szafir at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93571: Szafir path traversal in update filename handling

CVE-2026-93571 · Severity: info · Published 2026-10-29

Szafir is an electronic signature application used for document signing and verification in Poland. A man-in-the-middle attacker who intercepts update requests can redirect them to a malicious server and write arbitrary XML files to attacker-chosen locations on the system, potentially compromising the application's integrity or enabling further attacks.

Technologies: Krajowa Izba Rozliczeniowa Szafir. Vendors: Krajowa Izba Rozliczeniowa.

Quick answers

Is CVE-2026-93571 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-93571 being exploited in the wild.
How severe is CVE-2026-93571?: Informational severity, published 29 October 2026.
Which products and versions are affected?: Krajowa Izba Rozliczeniowa Szafir all versions up to build 708 of version 2.0.0.
Is there a fix for CVE-2026-93571?: Yes: fixed in Szafir 2.0 build 708. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-93571 attacked?: It is attacked over the network or from the adjacent network, in a software library.
Am I affected by CVE-2026-93571?: Check whether you run Krajowa Izba Rozliczeniowa Szafir at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Szafir 2.0 build 708

Technical details

The vulnerability is a path traversal flaw (CWE-22) in Szafir's update mechanism. An attacker positioned to intercept HTTPS traffic can reroute update requests to their own server and provide a specially crafted XML file with path traversal sequences in the filename; the application fails to validate the filename and writes the file to the attacker-specified path. This requires network-level MITM capability but is exacerbated by CVE-2026-106036 (improper certificate validation), which allows the attacker to impersonate the update server without a valid certificate.

Affected products

Krajowa Izba Rozliczeniowa Szafir all versions up to build 708 of version 2.0.0

Timeline

2026-10-29: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.