KIR fixes Szafir e-signature flaws; Szafir Weryfikująca is left unpatched

KIR fixes Szafir e-signature flaws; Szafir Weryfikująca is left unpatched

29 October 2026: CERT Polska has published three vulnerabilities in Szafir, the electronic signature application of Krajowa Izba Rozliczeniowa (KIR), the Polish clearing house that is also a qualified trust service provider. Szafir version 2.0 build 708 fixes them, but the separate verification tool, Szafir Weryfikująca, is end of life and has not been fixed, in CERT Polska's words.

Not yet independently verified. The advisory comes from CERT Polska; we did not find a KIR security notice, and it gives no CVSS scores and no statement on exploitation. We will update this when it can be confirmed, and remove this note.

What the three flaws allow

• CVE-2026-93570 (XML external entity): Szafir and Szafir Weryfikująca process external entities in XML, so signing or verifying a crafted XML file can make the program read arbitrary files from the user's computer.
• CVE-2026-93571 (path traversal): a filename in an update could be manipulated by an attacker able to intercept the update request, so that a file is written outside the intended folder.
• CVE-2026-106036 (no certificate validation): the software accepted any client or server certificate without checking the certificate or the hostname, which is what makes the update interception in the second flaw practical.

Mikus Teivens of Critical Security reported the flaws.

Who uses Szafir

Szafir is the application many Polish holders of KIR qualified signature cards use to sign tax returns, court filings, public tenders and contracts, and to sign XML documents such as e-invoices and statements in the formats Polish administrations require. That puts it on the desktops of accountants, lawyers, procurement teams and company boards. The XXE flaw is the most direct risk for them: a document received from a counterparty and opened for verification could be built to read files from the machine doing the checking.

Updating, and replacing the verifier

Organisations that use KIR signatures should:

• update Szafir to version 2.0 build 708 on every machine that signs or verifies documents;
• remove Szafir Weryfikująca, since it will not be fixed, and verify signatures with the updated Szafir or another supported validator;
• treat XML files from outside the organisation with care on machines that still run an older version;
• update only from trusted networks until the patch is in place, because the certificate flaw lets an interceptor tamper with the update itself.

Our catalogue lists 11 digital signature software products for teams reviewing their signing tools.

Sources

• CERT Polska: vulnerabilities in Szafir software (CVE-2026-93570, CVE-2026-93571, CVE-2026-106036), 29 October 2026