proCertum SmartSign fails to validate the schema of the Certificate Practice Statement (CPS) URI, allowing the creation of a certificate containing an arbitrary URI. When a victim opens a document signed with such a certificate, the application trusts the CPS URI and executes the referenced local file or opens the indicated webpage, thereby permitting the attacker to run arbitrary code on the victim’s machine. This flaw is a typical instance of CWE‑73 (OS Command Injection via unsanitized file paths). The impact is the execution of code or external content on the user’s system, potentially compromising confidentiality, integrity, and availability.

The vulnerability applies to Asseco’s proCertum SmartSign software, specifically versions released before 9.4.3.90. The fix was introduced in version 9.4.3.90 and removes the unsanitized handling of the CPS URI.

The CVSS score is 4.6, indicating moderate severity. The EPSS score is 0.00085, indicating a very low but non-zero exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. The most likely attack vector is a social‑engineering scenario where an adversary sends a signed document to a victim via email or another delivery channel. Once the victim opens the document in proCertum SmartSign, the unsafe CPS URI is processed and the attacker’s payload is executed. Although the exploitation requires user interaction, the flaw allows arbitrary code execution, which makes it a significant risk when the business relies on proCertum SmartSign for document signing.