CVE-2026-25827
Local File Enumeration
Issue summary
A number of properties were identified to not have any restrictions to what path they can be set to by an admin user. Setting these properties to specific file paths can reveal information to the clientside.
Three specific properties were identified:
The property ATTRIBUTESFILE in PKCS11CryotoToken can be set to a readable but not an accepted (i.e recognized with attributes) file. In this case an error is thrown, confirming the existence of the file. See also CVE-2026-25825.
The property KEYSTOREPATH in KeyStoreCryptoToken can be set to a non-existing file which will return an error confirming to the clientside that the file does not exist.
The property TRUSTSTOREPATH in RenewalWorker can be set to any path without any restrictions by an admin user. In the case that the provided path points to an existing file, readable by the user running the application server, but is not a recognized PEM format, it will return this as an error to the clientside, confirming the existences of the file.
Severity
Keyfactor rates the severity as medium with a CVSS score of CVSS 5.1. Assigned CVE-2026-25827.
Who is affected?
All SignServer users prior to 7.6.0.
Risk assessment
An authorized Admin user can get information on the client side if the set file path points to an existing file on the server.
Mitigation
Upgrade to SignServer 7.6 or later.
Additional information
Should you have any additional questions, please reach out to support@keyfactor.com.
Comments
Article is closed for comments.