CVE-2026-25827

An issue was discovered in Keyfactor SignServer before 7.6.0. A number of properties were identified to not have any restrictions to what path they can be set to by an admin user. Setting these properties to specific file paths can reveal information to the client side. Three specific properties...

CVE-2026-25827

Keyfactor SignServer versions before 7.6.0 are affected by a local file enumeration vulnerability. Three configuration properties — ATTRIBUTESFILE (PKCS11CryptoToken), KEYSTOREPATH (KeyStoreCryptoToken), and TRUSTSTOREPATH (RenewalWorker) — accept arbitrary file paths without validation. When an ...