Vulnerabilities · 77 days ago

Signed SzafirHost Archives Can Hide Unchecked Native Code

SzafirHost can trust a package’s signature and still unpack native code that was never covered by that signature. The break is between verification and extraction: one parser checks the archive index, a different parser reads the stream and writes out an injected DLL, SO, or DYLIB that can lead to remote code execution.

CERT Polska says CVE-2026-13165 was fixed in SzafirHost 1.2.2. The flaw affects downloaded native library archives, where a malicious entry placed outside the Central Directory is invisible to the signature check but still extracted by the unpacker.

Timeline

• Jun 29 Reported by CERT Polska

Sources

1 source covering this story

• CERT Polska Jun 29

  Vulnerability in SzafirHost software

  Unrestricted Upload of File with Dangerous Type vulnerability (CVE-2026-13165) has been found in SzafirHost software.

Entities

• CVE-2026-13165

Part of the PlainSec briefing for 2026-06-29

Editions

• Briefing for 2026-06-29

Related stories

• Oracle Payments Bug Can Leak the Keys Behind It
• Forged Technician Logins Put RMM Fleets at Risk
• AI Pushes Vulnerability Work Past Human Pace