CVE-2026-112198
Improper Restriction of XML External Entity Reference in Tactis' NoviGest Desktop App
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
XML External Entity (XXE) injection vulnerability in the SAFT import feature of the NoviGest Desktop App. The application processes user-controlled XML files using a JAXB Unmarshaller without properly disabling external entity resolution. An attacker with access to this functionality could provide a manipulated XML file to read local files accessible to the application process. If the application runs with elevated privileges, sensitive system files could be exposed.
| CWE | CWE-611 |
| Vendor | tactis |
| Product | novigest desktop app |
| Published | Oct 28, 2026 |
| Last Updated | Oct 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for tactis novigest desktop app
Be the first to know when new unknown vulnerabilities affecting tactis novigest desktop app are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Tactis / NoviGest Desktop App
NoviGest Desktop App prior to version 8.0.0-300
References
Credits
Pablo Jordán Lucia Marina Jiali Villalta Cerezo