Path traversal in Szafir lets attackers write files
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Szafir from 0 through 2.0 is affected by a path traversal flaw (CWE-22) in the uploaded filename. A man-in-the-middle attacker who can reroute update requests to their own server can supply an XML file that Szafir saves to a location the attacker chooses.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Description from the CNA
Szafir is vulnerable to Path Traversal in the uploaded filename. A man-in-the-middle attacker who can reroute update request to their server can prepare arbitrary XML file that will be saved in location chosen by attacker. This issue was fixed in version 2.0 build 708.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Krajowa Izba Rozliczeniowa | Szafir | up to 2.0 | — | No fix listed | CNA |
- Szafir VendorKrajowa Izba Rozliczeniowa Affected up to 2.0 Fixed in — No fix listed CNA
Remediation
The source description states that the issue was fixed in Szafir version 2.0 build 708.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Vendor assessments
Timeline
- 2026-10-29 Threatist record created from CVE-2026-93571
- 2026-10-29 Alias added: GHSA-r7x2-99wq-6g6f
- 2026-11-05 CISA SSVC decision points changed
- 2026-11-07 Affected versions changed · Red Hat
- 2026-11-07 CVSS score added · Red Hat
References
More Krajowa Izba Rozliczeniowa vulnerabilities
- TI-2026-07960 Improper Certificate Verification in Szafir SDK CVSS 4.0CRITICAL 9.3
- TI-2026-21415 Lack of Dynamic Library Validation in SzafirHost CVSS 4.0HIGH 8.7
- TI-2026-32104 Remote Code Execution in SzafirHost CVSS 4.0HIGH 8.6
- TI-2026-11178 Remote Code Execution in SzafirHost CVSS 4.0HIGH 8.6
- TI-2026-82552 Szafir accepts unvalidated TLS certificates for update downloads CVSS 4.0MEDIUM 6.9
- TI-2026-82528 XML external entity injection in Szafir and Szafir Weryfikująca CVSS 4.0HIGH 8.2
Sources
- CVE-2026-93571 · CVE Program
- CVE-2026-93571 · NVD
- FIRST EPSS
- GHSA-r7x2-99wq-6g6f · GitHub Advisory Database · CC BY 4.0
- CVE-2026-93571 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences