Vulnerabilities & Exploits

Signed SzafirHost archives can hide unchecked native code

SzafirHost can trust a package’s signature and still unpack native code that was never covered by that signature. The break is between verification and extraction: one parser checks the archive index, a different parser reads the stream and writes out an injected DLL, SO, or DYLIB that can lead to remote code execution.

CERT Polska says CVE-2026-13165 was fixed in SzafirHost 1.2.2. The flaw affects downloaded native library archives, where a malicious entry placed outside the Central Directory is invisible to the signature check but still extracted by the unpacker.

1 source · Jun 29

Timeline

• Jun 29 Reported by CERT Polska

Sources

• Jun 29 CERT Polska

  Vulnerability in SzafirHost software

  Unrestricted Upload of File with Dangerous Type vulnerability (CVE-2026-13165) has been found in SzafirHost software.

  original

Part of the PlainSec briefing for 2026-06-29

Every edition of this story: Signed SzafirHost archives can hide unchecked native code

More from today

• Oracle Payments bug can leak the keys behind it
• Forged technician logins put RMM fleets at risk
• AI pushes vulnerability work past human pace