CVE-2026-26928
Gravedad CVSS v4.0:
ALTA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
02/04/2026
Última modificación:
02/04/2026
Descripción
*** Pendiente de traducción *** SzafirHost downloads necessary files in the context of the initiating web page. When called, SzafirHost updates its dynamic library. JAR files are correctly verified based on a list of trusted file hashes, and if a file was not on that list, it was checked to see if it had been digitally signed by the vendor. The application doesn&#39;t verify hash or vendor&#39;s digital signature of uploaded DLL, SO, JNILIB or DYLIB file. The attacker can provide malicious file which will be saved in users /temp folder and executed by the application.<br />
<br />
This issue was fixed in version 1.1.0.
Impacto
Puntuación base 4.0
8.70
Gravedad 4.0
ALTA