CVE-2026-112198 | BDVDB-2026-397172 Detail

Description#

XML External Entity (XXE) injection vulnerability in the SAFT import feature of the NoviGest Desktop App. The application processes user-controlled XML files using a JAXB Unmarshaller without properly disabling external entity resolution. An attacker with access to this functionality could provide a manipulated XML file to read local files accessible to the application process. If the application runs with elevated privileges, sensitive system files could be exposed.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-10-28Record published in the CVE List.