Arbitrary file upload in Krajowa Izba Rozliczeniowa Szafirhost

CVE-2026-44088

SzafirHost verifies the signature of the downloaded JAR file using class JarInputStream (reading from the beginning of the file), but loads classes using class JarFile/URLClassLoader (reading the Central Directory from the end). It can lea…

Vulnerability class: Unrestricted File Upload

EPSS: 0.004 (63.6th percentile) — read the EPSS interpretation.