An XML External Entity (XXE) injection vulnerability exists in the SAFT import feature of the NoviGest Desktop App. The vulnerability arises because the application processes user-supplied XML files using a JAXB Unmarshaller without disabling external entity resolution. This allows an attacker who can supply crafted XML files to read local files accessible to the application process. If the application runs with elevated privileges, sensitive system files could be exposed.