Vulnerability in SzafirHost software

CERT Polska has received a report about vulnerability in SzafirHost software and participated in coordination of its disclosure.

The vulnerabilityCVE-2026-44088: SzafirHost verifies the signature of the downloaded JAR file using classJarInputStream(reading from the beginning of the file), but loads classes using classJarFile/URLClassLoader(reading the Central Directory from the end). It can lead to remote code execution by allowing an attacker to combine a genuine, signed JAR file with a malicious ZIP file, causing the verification to pass but the malicious class to be loaded.

This issue was fixed in version 1.2.1.

We thank Mariusz Maik for the responsible vulnerability report.