CVE-2026-57917

Vulnerability Description

proCertum SmartSign parses external XML entities from arbitrary crafted signature files, enabling SSRF and potentially allowing the reading of local files, depending on the parser's configuration. The XML External Entity (XXE) vulnerability is triggered simply by previewing a file in the file selection window, before the victim clicks “Open”.

This issue was fixed in version 9.4.3.90.

Vulnerability Details

Published Date

July 27, 2026

Last Modified

July 27, 2026

CWE ID

CWE-611

Source

NVD

Vendor

Asseco

Product

proCertum SmartSign

External References

https://cert.pl/posts/2026/07/CVE-2026-57916
https://pomoc.certum.pl/pl/oprogramowanie/procertum-smartsign/

CVE-2026-57917

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment