CVE-2026-26928
HighSummary
A vulnerability in SzafirHost is due to lack of hash or digital signature verification for DLL, SO, JNILIB, or DYLIB files. An attacker can provide a malicious file that gets saved in the temp folder and executed by the application. Fixed in version 1.1.0.
Risk Assessment
An attacker can execute malicious code in the context of the application, potentially leading to system compromise or data theft.
Recommendation
Update SzafirHost to version 1.1.0 or later.
Other vulnerabilities in SzafirHost
See all- CVE-2026-13165High
A vulnerability in SzafirHost allows an attacker to inject a malicious native library into a JAR archive that is signed and verified. The signature verification uses a JarFile parser (reading the Central Directory), while extraction uses a JarInputStream parser (reading sequentially from local file headers). An attacker can insert a library entry between the last legitimate entry and the Central Directory, which is not seen by the signature verifier but is read and written by the extractor, leading to remote code execution.
- CVE-2026-44088High
SzafirHost verifies the signature of the downloaded JAR file, but loads classes in a way that can lead to remote code execution. An attacker can combine a genuine, signed JAR file with a malicious ZIP file, allowing the malicious class to be loaded despite successful verification.
Original NVD description (English source)
SzafirHost downloads necessary files in the context of the initiating web page. When called, SzafirHost updates its dynamic library. JAR files are correctly verified based on a list of trusted file hashes, and if a file was not on that list, it was checked to see if it had been digitally signed by the vendor. The application doesn't verify hash or vendor's digital signature of uploaded DLL, SO, JNILIB or DYLIB file. The attacker can provide malicious file which will be saved in users /temp folder and executed by the application. This issue was fixed in version 1.1.0.