Vulnerability · Published May 15, 2026 · Assigned by CERT-PL
CVE-2026-44088Remote Code Execution in SzafirHost
High 8.6
In plain English
A high-severity unrestricted file upload in SzafirHost from Krajowa Izba Rozliczeniowa. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).
Official description
SzafirHost verifies the signature of the downloaded JAR file using class JarInputStream (reading from the beginning of the file), but loads classes using class JarFile/URLClassLoader (reading the Central Directory from the end). It can lead to remote code execution by allowing an attacker to combine a genuine, signed JAR file with a malicious ZIP file, causing the verification to pass but the malicious class to be loaded. This issue was fixed in version 1.2.1.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Krajowa Izba Rozliczeniowa | SzafirHost | 0 – before 1.2.1 |
Weakness: CWE-434 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
References
- https://cert.pl/posts/2026/05/CVE-2026-44088 third-party-advisory
- https://www.elektronicznypodpis.pl/ product