Is there a patch available for CVE-2026-57917?

Yes, a patch is available for CVE-2026-57917. Update the affected software to the latest version immediately.

proCertum SmartSign CVE-2026-57917

Q: What is the CVSS score of CVE-2026-57917?

CVE-2026-57917 has a CVSS 4.0 base score of 4.8 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-49143 MEDIUM

Improper Restriction of XML External Entity Reference (CWE-611)

2026-07-27 CERT-PL

GHSA-fqfw-hf3f-2q4c

SSRF XXE Procertum Smartsign

4.8

CVSS 4.0 · Vendor: CERT-PL

Severity by source

Vendor (CERT-PL) PRIMARY

4.8 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.4 MEDIUM

Local access required; user interaction needed to preview file; limited confidentiality and integrity impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (CERT-PL).

CVSS VectorVendor: CERT-PL

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 27, 2026 - 12:16 EUVD

Analysis Generated

Jul 27, 2026 - 11:47 vuln.today

DescriptionCVE.org

proCertum SmartSign parses external XML entities from arbitrary crafted signature files, enabling SSRF and potentially allowing the reading of local files, depending on the parser's configuration. The XML External Entity (XXE) vulnerability is triggered simply by previewing a file in the file selection window, before the victim clicks “Open”.

This issue was fixed in version 9.4.3.90.

AnalysisAI

XML External Entity processing in proCertum SmartSign allows server-side request forgery (SSRF) and local file disclosure via crafted signature files. The vulnerability is triggered when a victim merely previews a malicious file in the file selection window, before clicking Open. patched in version 9.4.3.90. No active exploitation or public exploit code identified.

Technical ContextAI

The vulnerability is an XML External Entity (XXE) injection (CWE-611) in the XML parser used by proCertum SmartSign to process digital signature files. By embedding external entity references in a crafted XML-based signature, an attacker can force the parser to fetch remote resources (SSRF) or read local files, depending on parser configuration. The CPE data indicates all versions of proCertum SmartSign prior to 9.4.3.90 are affected. The attack exploits the parser's default behavior without requiring authentication.

RemediationAI

Upgrade to proCertum SmartSign version 9.4.3.90 or later, per vendor advisory. No workarounds are documented; restricting user ability to open untrusted signature files or employing application whitelisting may mitigate risk. Disabling external entity parsing in the XML parser configuration, if feasible, would also prevent exploitation, but the vendor fix is the recommended action.