CVE-2026-112198

HighCVSS 8.3

Published: 28/10/2026(UTC)Translated: 28/10/2026(UTC)NVD NIST

Summary

The NoviGest Desktop App contains an XML External Entity (XXE) injection vulnerability in the SAFT import feature. The application processes user-controlled XML files using a JAXB Unmarshaller without properly disabling external entity resolution. An attacker could provide a manipulated XML file to read local files accessible to the application process.

Risk Assessment

This could lead to disclosure of sensitive system files, especially if the application runs with elevated privileges.

Recommendation

Disable external entity resolution in the JAXB Unmarshaller and update the application to a patched version.

Other vulnerabilities in NoviGest Desktop App

CVE-2026-112197Critical
The NoviGest Desktop App's Java RMI service lacks authentication in critical functions. An attacker with network access can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The elevated privileges of the database account allow these capabilities to be chained to execute operating system commands on the server.

Original NVD description (English source)

XML External Entity (XXE) injection vulnerability in the SAFT import feature of the NoviGest Desktop App. The application processes user-controlled XML files using a JAXB Unmarshaller without properly disabling external entity resolution. An attacker with access to this functionality could provide a manipulated XML file to read local files accessible to the application process. If the application runs with elevated privileges, sensitive system files could be exposed.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS