CVE-2026-57917 Overview
CVE-2026-57917 is an XML External Entity (XXE) vulnerability in proCertum SmartSign, a digital signature client developed by Certum. The application parses external XML entities from crafted signature files, enabling Server-Side Request Forgery (SSRF) and, depending on parser configuration, disclosure of local files. Exploitation triggers when a user previews a malicious signature file in the file selection window, before clicking Open. The vendor fixed the flaw in version 9.4.3.90. The issue is classified under CWE-611: Improper Restriction of XML External Entity Reference.
Critical Impact
Merely previewing a crafted signature file in the file picker can trigger outbound SSRF and potentially expose local file contents from the user's workstation.
Affected Products
- proCertum SmartSign versions prior to 9.4.3.90
- Certum digital signature client for Windows workstations
- Any environment using proCertum SmartSign for XAdES or PAdES signature preview and creation
Discovery Timeline
- 2026-07-27 - CVE-2026-57917 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-57917
Vulnerability Analysis
The vulnerability resides in the XML parser used by proCertum SmartSign to process signature files. The parser resolves external entity references embedded within the input XML without disabling external entity expansion. An attacker crafts a signature file that declares an external DOCTYPE containing entities pointing to internal URLs or file:// URIs. When the user browses to a directory containing the malicious file, the file preview logic parses the XML and dereferences the external entities. The attacker does not need the victim to open or sign the file — hovering or single-click preview is sufficient.
Successful exploitation yields two primary outcomes. First, the client issues attacker-controlled outbound HTTP requests from the victim workstation, delivering SSRF against internal network resources. Second, depending on parser configuration and entity type, the contents of local files readable by the current user can be exfiltrated to an attacker-controlled endpoint through out-of-band XXE techniques.
Root Cause
The root cause is unsafe XML parser configuration. External entity resolution and DTD processing remain enabled when SmartSign parses untrusted signature files. Secure XML parsing requires disabling DOCTYPE declarations, external general entities, and external parameter entities before processing untrusted input.
Attack Vector
The attack vector is local and requires user interaction, but the interaction is minimal. An attacker delivers a crafted signature file through email attachments, shared folders, USB media, or drive-by download. The victim opens the SmartSign file selection dialog and navigates to the folder containing the file. The preview handler parses the XML and processes the malicious external entity references, initiating the SSRF or file read.
No verified public exploit code is available for CVE-2026-57917. Refer to the CERT.pl analysis for technical details on the entity handling behavior.
Detection Methods for CVE-2026-57917
Indicators of Compromise
- Unexpected outbound HTTP or HTTPS connections originating from the proCertumSmartSign.exe process to unfamiliar external hosts
- Signature files with .xml, .xades, or .xsig extensions that contain <!DOCTYPE> declarations or <!ENTITY SYSTEM ...> references
- Outbound DNS queries from workstations to attacker-controlled domains immediately after users browse shared directories in SmartSign
Detection Strategies
- Inspect signature files on file shares and mail gateways for DTD declarations and external entity references before delivery to endpoints
- Correlate proCertumSmartSign.exe process activity with network egress logs to flag outbound requests to non-Certum infrastructure
- Deploy YARA rules that match XML files containing SYSTEM entity references combined with signature file extensions
Monitoring Recommendations
- Enable process and network telemetry collection on workstations where SmartSign is installed and forward events to a central SIEM
- Alert on any file://, http://, or https:// reads issued by the SmartSign process to non-standard destinations
- Track SmartSign version inventory across the estate to identify hosts still running builds prior to 9.4.3.90
How to Mitigate CVE-2026-57917
Immediate Actions Required
- Upgrade all proCertum SmartSign installations to version 9.4.3.90 or later
- Instruct users to avoid browsing untrusted directories through the SmartSign file selection dialog until patching completes
- Block inbound delivery of signature files from external senders at the mail gateway pending investigation
Patch Information
Certum fixed CVE-2026-57917 in proCertum SmartSign version 9.4.3.90. Download and deployment instructions are available through the Certum proCertum SmartSign product page. Verify the installed version through the application's About dialog after upgrade.
Workarounds
- Restrict outbound network access from workstations running vulnerable SmartSign builds to only Certum and internal signing infrastructure endpoints
- Store signature files only in trusted, access-controlled directories and disable SmartSign browsing of general-purpose network shares
- Apply application allowlisting to prevent users from launching SmartSign in environments where the patch cannot yet be deployed
# Verify installed proCertum SmartSign version on Windows
wmic product where "Name like '%%SmartSign%%'" get Name,Version
# Block outbound traffic from SmartSign to non-Certum destinations (example)
New-NetFirewallRule -DisplayName "Block SmartSign Egress" `
-Program "C:\Program Files\Certum\proCertumSmartSign\proCertumSmartSign.exe" `
-Direction Outbound -Action Block
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
