XML External Entity Injection in NoviGest Desktop App by Tactis
CVE-2026-112198

8.3HIGH

Key Information:

Vendor

Tactis

Status
Novigest Desktop App
Vendor
CVE Published:
28 October 2026

What is CVE-2026-112198?

An XML External Entity (XXE) injection vulnerability exists in the SAFT import feature of the NoviGest Desktop App. This flaw arises from the application's handling of user-controlled XML files using a JAXB Unmarshaller without adequately disabling external entity resolution. An attacker exploiting this vulnerability can manipulate an XML file to access local files available to the application process, potentially exposing sensitive information, especially if the application is executed with elevated privileges.

Affected Version(s)

NoviGest Desktop App NoviGest Desktop App prior to version 8.0.0-300

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multip...

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Pablo Jordán Lucia
Marina Jiali Villalta Cerezo
.