CVE-2026-25825

LowCVSS 2.7/10Last modified Sep 22, 2026

Description

An issue was discovered in Keyfactor SignServer before 7.6.0. The output file to which SignerStatusReportWorker logs the report can be set to any path, even one that points to a file that already exists. This gives a user (with admin access) the possibility to write files in arbitrary directories in the server filesystem and potentially overwrite files accessible by the local user JBoss.

Metrics

CVSS 3.1 2.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-706

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 15, 2026
Last modified: Sep 22, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-258264.9An issue was discovered in Keyfactor SignServer before 7.6.0. The attribute ATTRIBUTESFILE in PKCS11CryptoToken can be set to a readable fil CVE-2026-258272.3An issue was discovered in Keyfactor SignServer before 7.6.0. A number of properties were identified to not have any restrictions to what pa CVE-2026-258285.4grub-btrfs through 2026-01-31 (on Arch Linux and derivative distributions) allows initramfs OS command injection because it does not sanitiz CVE-2026-25836.4The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `blocksy_meta` metadata fields in all versions up to, a CVE-2026-258323.7In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group.CVE-2026-258337.5Mbed TLS 3.5.0 to 3.6.5 fixed in 3.6.6 and 4.1.0 has a buffer overflow in the x509_inet_pton_ipv6() function CVE-2026-258346.5Mbed TLS v3.3.0 up to 3.6.5 and 4.0.0 allows Algorithm Downgrade.CVE-2026-258357.7Mbed TLS before 3.6.6 and TF-PSA-Crypto before 1.1.0 misuse seeds in a Pseudo-Random Number Generator (PRNG).CVE-2026-258367.2An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox Cloud 5 CVE-2026-25849.3A critical SQL Injection (SQLi) vulnerability has been identified in the authentication module of the system. An unauthenticated, remote att CVE-2026-258466.5In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs CVE-2026-258476.1In JetBrains PyCharm before 2025.3.2 a DOM-based XSS on Jupyter viewer page was possible