NoviGest Desktop App EUVD-2026-111993

Exploitation requires the attacker to (1) have authenticated low-privileged access to the NoviGest Desktop App (PR:L) with the ability to reach and use the SAFT import feature, and (2) supply a manipulated SAF-T XML file to that feature, which is parsed by a JAXB Unmarshaller with external entity resolution left enabled. The attack vector is local (AV:L) - not remote - so it presumes a user account or host foothold rather than network reachability. The severity of disclosure is gated by the privileges of the application process: reading is limited to files accessible to that process, and exposure of sensitive system files specifically requires the application to be running with elevated privileges (a non-default/deployment-dependent limiting factor). No victim user interaction is required (UI:N).

This is a genuinely severe-on-paper (CVSS 8.3, CVSS:4.0) XXE flaw whose real-world urgency is tempered by its access requirements. The vector is local (AV:L) and requires an authenticated low-privileged user (PR:L), so this is not a remote, unauthenticated, internet-facing exploitation scenario - it needs a user who can already reach the SAFT import feature. Attack complexity is low (AC:L) and no attack requirements or user interaction by a victim are needed (AT:N/UI:N), so for someone who already has that access the flaw is reliably triggerable. No EPSS score, CISA KEV listing, or PoC/exploit reference is present in the input, so there is no public exploit identified at time of analysis and no signal of active or widespread exploitation. The vuln.today decision label is 'this_week' - a priority to patch promptly but explicitly below act_now/emergency, which is consistent with a high-impact-but-access-gated local vulnerability in a niche product. Bottom line: a real, high-impact confidentiality issue worth patching this week, but the local + authenticated prerequisites and the low deployment footprint make it a targeted/insider-leaning risk rather than a mass-exploitation emergency.

A low-privileged but legitimate user of the NoviGest Desktop App (or an attacker who has obtained such an account or a foothold on the host) crafts a malicious SAF-T XML file containing an external entity declaration and imports it through the SAFT import feature. The JAXB Unmarshaller resolves the external entity, causing the application to read a local file accessible to its process and expose its contents; if the app runs with elevated privileges, sensitive system files can be disclosed. No public exploit has been identified at time of analysis.