Szafir and Szafir Weryfikująca are affected by an XML External Entity (XXE) injection vulnerability (CVE-2026-93570). This flaw allows an attacker to craft XML files with external DTD references, enabling the XML parser to process external entities and potentially read arbitrary files from the victim's filesystem. The vulnerability has been fixed in Szafir version 2.0 build 708. Szafir Weryfikująca is no longer supported and remains unpatched.