# CVE-2026-93571: Szafir path traversal in update filename handling

Source: https://junglewise.ai/threats/cve-2026-93571-szafir-is-vulnerable-to-path-traversal-in-the-uploaded-filename-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-93571 · Severity: info · Published 2026-10-29

Szafir is an electronic signature application used for document signing and verification in Poland. A man-in-the-middle attacker who intercepts update requests can redirect them to a malicious server and write arbitrary XML files to attacker-chosen locations on the system, potentially compromising the application's integrity or enabling further attacks.

Technologies: [Krajowa Izba Rozliczeniowa Szafir](https://junglewise.ai/threats/technologies/szafir). Vendors: [Krajowa Izba Rozliczeniowa](https://junglewise.ai/threats/vendors/krajowa-izba-rozliczeniowa).

## Quick answers

**Is CVE-2026-93571 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93571 being exploited in the wild.

**How severe is CVE-2026-93571?** Informational severity, published 29 October 2026.

**Which products and versions are affected?** Krajowa Izba Rozliczeniowa Szafir all versions up to build 708 of version 2.0.0.

**Is there a fix for CVE-2026-93571?** Yes: fixed in Szafir 2.0 build 708. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-93571 attacked?** It is attacked over the network or from the adjacent network, in a software library.

**Am I affected by CVE-2026-93571?** Check whether you run Krajowa Izba Rozliczeniowa Szafir at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Szafir 2.0 build 708

## Technical details

The vulnerability is a path traversal flaw (CWE-22) in Szafir's update mechanism. An attacker positioned to intercept HTTPS traffic can reroute update requests to their own server and provide a specially crafted XML file with path traversal sequences in the filename; the application fails to validate the filename and writes the file to the attacker-specified path. This requires network-level MITM capability but is exacerbated by CVE-2026-106036 (improper certificate validation), which allows the attacker to impersonate the update server without a valid certificate.

## Affected products

- Krajowa Izba Rozliczeniowa Szafir all versions up to build 708 of version 2.0.0

## Timeline

- 2026-10-29: disclosed

## References

- [https://cert.pl/posts/2026/10/CVE-2026-93570](https://cert.pl/posts/2026/10/CVE-2026-93570)
- [https://www.elektronicznypodpis.pl/](https://www.elektronicznypodpis.pl/)

## Related threats

- [Szafir XML External Entity injection in XML signing](https://junglewise.ai/threats/cve-2026-93570-szafir-and-szafir-weryfikujaca-are-vulnerable-to-xml-external)
- [Szafir improper certificate validation in HTTPS connections](https://junglewise.ai/threats/cve-2026-106036-szafir-accepts-any-client-or-server-certificate-without)