{"id":"CVE-2026-112198","aliases":[],"title":"Improper Restriction of XML External Entity Reference in Tactis' NoviGest Desktop App","titleSource":"INCIBE","descriptionSource":"INCIBE","products":[{"vendor":"Tactis","name":"NoviGest Desktop App","platforms":[],"versions":[{"version":"NoviGest Desktop App prior to version 8.0.0-300","status":"affected"}],"defaultStatus":"unaffected","source":"INCIBE","url":"https://www.cve.org/CVERecord?id=CVE-2026-112198"}],"remediation":[{"text":"Update the NoviGest Desktop App to version 8.0.0-300, in which the vendor confirms that the vulnerability has been fixed.\nFor CVE-2026-112198, XML processing uses an XMLStreamReader with DTDs and external entities disabled. Schema validation employs secure processing and blocks access to external DTDs and schemas.","source":"INCIBE","url":"https://www.cve.org/CVERecord?id=CVE-2026-112198"}],"description":"XML External Entity (XXE) injection vulnerability in the SAFT import feature of the NoviGest Desktop App. The application processes user-controlled XML files using a JAXB Unmarshaller without properly disabling external entity resolution. An attacker with access to this functionality could provide a manipulated XML file to read local files accessible to the application process. If the application runs with elevated privileges, sensitive system files could be exposed.","severity":"high","score":8.3,"published":"2026-10-28T10:20:06.729Z","modified":"2026-10-28T10:21:56.415Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tactis-novigest-desktop-app"],"sources":[{"name":"CVE","id":"CVE-2026-112198","modified":"2026-10-28T10:21:56.415Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-112198"}],"assessments":[{"source":"INCIBE","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N","score":8.3}],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T17:55:31.619Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-10-28T10:55:32.941Z","attemptedAt":"2026-10-28T10:55:32.941Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-28T10:55:32.251Z","attemptedAt":"2026-10-28T10:55:32.251Z"},{"source":"EUVD","status":"refresh-failed","attemptedAt":"2026-10-28T10:55:32.251Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-28T10:55:32.941Z","attemptedAt":"2026-10-28T10:55:32.941Z"}],"evidence":[]}