Lack of Dynamic Library Validation in SzafirHost
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
SzafirHost downloads necessary files in the context of the initiating web page. When called, SzafirHost updates its dynamic library. JAR files are correctly verified based on a list of trusted file hashes, and if a file was not on that list, it was checked to see if it had been digitally signed by the vendor. The application doesn't verify hash or vendor's digital signature of uploaded DLL, SO, JNILIB or DYLIB file. The attacker can provide malicious file which will be saved in users /temp folder and executed by the application. This issue was fixed in version 1.1.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Krajowa Izba Rozliczeniowa | SzafirHost | before 1.1.0 | 1.1.0 | Patch available | CNA |
- SzafirHost VendorKrajowa Izba Rozliczeniowa Affected before 1.1.0 Fixed in 1.1.0 Patch available CNA
Remediation
- Fix · CNA SzafirHost (Krajowa Izba Rozliczeniowa) Fixed in 1.1.0
Timeline
- 2026-10-02 Threatist record created from CVE-2026-26928
- 2026-10-03 Alias added: GHSA-cg6j-gw4m-cw76
References
More Krajowa Izba Rozliczeniowa vulnerabilities
- TI-2026-07960 Improper Certificate Verification in Szafir SDK CVSS 4.0CRITICAL 9.3
- TI-2026-32104 Remote Code Execution in SzafirHost CVSS 4.0HIGH 8.6
- TI-2026-11178 Remote Code Execution in SzafirHost CVSS 4.0HIGH 8.6
- TI-2026-82552 Szafir accepts unvalidated TLS certificates for update downloads CVSS 4.0MEDIUM 6.9
- TI-2026-82528 XML external entity injection in Szafir and Szafir Weryfikująca CVSS 4.0HIGH 8.2
- TI-2026-21414 URL (HTTP Origin) call location spoofing in Szafir SDK Web CVSS 4.0MEDIUM 5.1
Sources
- CVE-2026-26928 · CVE Program
- CVE-2026-26928 · NVD
- FIRST EPSS
- GHSA-cg6j-gw4m-cw76 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences