Remote Code Execution Vulnerability in SzafirHost by Elektroniczny Podpis

CVE-2026-44088

What is CVE-2026-44088?

The SzafirHost application encounters a vulnerability where it improperly verifies JAR file signatures during class loading. Specifically, while it uses JarInputStream to check the signature from the beginning of the file, it employs JarFile/URLClassLoader to load classes from the Central Directory located at the end of the file. This discrepancy allows an attacker to exploit the system by crafting a legitimate signed JAR file combined with a malicious ZIP file, thus bypassing verification while loading harmful code. The flaw was addressed in the release of version 1.2.1.

References