CVE-2026-25827

An issue was discovered in Keyfactor SignServer before 7.6.0. A number of properties were identified to not have any restrictions to what path they can be set to by an admin user. Setting these properties to specific file paths can reveal information to the client side. Three specific properties...

CVE-2026-25827

Keyfactor SignServer versions prior to 7.6.0 are vulnerable to local file enumeration due to a lack of path restrictions on specific administrative properties. An admin user can set the ATTRIBUTESFILE in PKCS11CryotoToken, KEYSTOREPATH in KeyStoreCryptoToken, or TRUSTSTOREPATH in RenewalWorker to...

EUVD-2026-78629

An issue was discovered in Keyfactor SignServer before 7.6.0. A number of properties were identified to not have any restrictions to what path they can be set to by an admin user. Setting these properties to specific file paths can reveal information to the client side. Three specific properties...

CVE-2026-25827: Insertion of Sensitive Information into Externally-Accessible File or Directory

An issue was discovered in Keyfactor SignServer before 7.6.0. A number of properties were identified to not have any restrictions to what path they can be set to by an admin user. Setting these properties to specific file paths can reveal information to the client side. Three specific properties...

CVE-2026-25827

An issue was discovered in Keyfactor SignServer before 7.6.0. A number of properties were identified to not have any restrictions to what path they can be set to by an admin user. Setting these properties to specific file paths can reveal information to the client side. Three specific properties...