Vulnerability · Published Oct 28, 2026 · Assigned by INCIBE
CVE-2026-112198Improper Restriction of XML External Entity Reference in Tactis' NoviGest Desktop App
High 8.3
In plain English
A high-severity XML external entity in NoviGest Desktop App from Tactis. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).
Official description
XML External Entity (XXE) injection vulnerability in the SAFT import feature of the NoviGest Desktop App. The application processes user-controlled XML files using a JAXB Unmarshaller without properly disabling external entity resolution. An attacker with access to this functionality could provide a manipulated XML file to read local files accessible to the application process. If the application runs with elevated privileges, sensitive system files could be exposed.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Tactis | NoviGest Desktop App | NoviGest Desktop App prior to version 8.0.0-300 |
Weakness: CWE-611 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N