PT-2026-64889 · Procertum · Smartsign

Mariusz Maik · CVE-2026-57917 · Published 2026-07-27 · Updated 2026-07-27

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions proCertum SmartSign versions prior to 9.4.3.90

Description proCertum SmartSign parses external XML entities from crafted signature files, which enables Server-Side Request Forgery (SSRF) and potentially allows the reading of local files, depending on the parser's configuration. This XML External Entity (XXE) issue is triggered when a user previews a file in the file selection window, occurring before the file is actually opened.

Recommendations Update to version 9.4.3.90.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2026-57917

Affected Products

Smartsign

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-57917 · Security Note
• https://cert.pl/posts/2026/07/CVE-2026-57916 · Note
• https://pomoc.certum.pl/pl/oprogramowanie/procertum-smartsign · Note
• https://t.me/CVEtracker/61333 · Telegram Post