CVE-2026-57917

MediumCVSS 4.8

Published: 27/07/2026(UTC)Updated: 24/10/2026(UTC)Translated: 27/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

An XXE vulnerability in proCertum SmartSign before version 9.4.3.90 allows parsing of external XML entities from crafted signature files, enabling SSRF and potentially local file reading. The vulnerability triggers simply by previewing a file in the selection window.

Risk Assessment

An attacker can access internal network resources or read sensitive files on the server, compromising system confidentiality and integrity.

Recommendation

Update proCertum SmartSign to version 9.4.3.90 or later, which fixes this vulnerability.

Other vulnerabilities in proCertum SmartSign

CVE-2026-57916Medium
A vulnerability in proCertum SmartSign before version 9.4.3.90 opens CPS URI without schema validation. An attacker can craft a certificate with a URI pointing to a local executable or URL, and when the victim opens the document, the file is executed.

Original NVD description (English source)

proCertum SmartSign parses external XML entities from arbitrary crafted signature files, enabling SSRF and potentially allowing the reading of local files, depending on the parser's configuration. The XML External Entity (XXE) vulnerability is triggered simply by previewing a file in the file selection window, before the victim clicks “Open”. This issue was fixed in version 9.4.3.90.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS