Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-57916— Arbitrary Path Execution via CPS URI in proCertum SmartSign

Quick assessment

Affected
Asseco proCertum SmartSign
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

proCertum SmartSign 在未进行模式验证的情况下打开了证书实践声明（CPS）统一资源标识符（URI）。攻击者可以构造一个任意证书，其 CPS URI 指向一个本地可执行文件或其他任意 URL，并用该证书对文档进行签名，然后将该文档发送给受害者。当受害者在应用程序中打开此文档时，指定的文件将被执行（或网页将被打开）。 此问题已在版本 9.4.3.90 中修复。

CVSS 4.6 · Medium EPSS 0.11% · P1

Affected Version Matrix 1

VendorProduct Version RangeStatus
Asseco proCertum SmartSign < 9.4.3.90 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-57916

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Arbitrary Path Execution via CPS URI in proCertum SmartSign
Source: CVE Program / CVE List V5
Vulnerability Description
proCertum SmartSign opens Certificate Practice Statement (CPS) URI without schema validation. An attacker can prepare arbitrary certificate with CPS URI pointing to a local executable file or any URL, sign a document with it, and send it to the victim. When the victim opens the document in the application, the specified file will be executed (or webpage will be opened). This issue was fixed in version 9.4.3.90.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
文件名或路径的外部可控制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Asseco proCertum SmartSign 0 ~ 9.4.3.90 -

II. Public POCs for CVE-2026-57916

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-57916

请登录查看更多情报信息。

Security Blog Posts for CVE-2026-57916 (1)

Vendor Pages for CVE-2026-57916 (1)

IV. Related Vulnerabilities

Same product: proCertum SmartSign
Same vendor: Asseco
Same weakness: CWE-73

V. Comments for CVE-2026-57916

No comments yet

Leave a comment