The flaw resides in SzafirHost’s handling of uploaded dynamic libraries. While JAR files are guarded by hash checking and vendor signatures, the software does not perform any verification for DLL, SO, JNILIB, or DYLIB files. A malicious actor can supply an invalid library that the application will load and execute, allowing arbitrary code to run with the privileges of the host process. The vulnerability therefore enables a remote attacker to compromise confidentiality, integrity, and availability of the affected system.

The issue affects installations of SzafirHost from Krajowa Izba Rozliczeniowa that are running versions earlier than 1.1.0. Any deployment that allows the web context to trigger dynamic library updates without proper validation is subject to this vulnerability.

With a CVSS score of 8.7 the vulnerability is classified as high severity. The EPSS score is not available, and it is not listed in CISA’s KEV catalog. The attack can be performed remotely by submitting a crafted DLL, SO, JNILIB, or DYLIB through the web interface that initiates library updates. While no public exploit has been detected, the high severity and lack of verification make exploitation likely if the software is deployed in an untrusted environment.