CVE-2026-25827
Received Received - Intake

Information Disclosure in Keyfactor SignServer

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: MITRE

Description
An issue was discovered in Keyfactor SignServer before 7.6.0. A number of properties were identified to not have any restrictions to what path they can be set to by an admin user. Setting these properties to specific file paths can reveal information to the client side. Three specific properties were identified: The property ATTRIBUTESFILE in PKCS11CryotoToken can be set to a readable but not an accepted (i.e., recognized with attributes) file. In this case an error is thrown, confirming the existence of the file. The property KEYSTOREPATH in KeyStoreCryptoToken can be set to a non-existing file that will return an error confirming to the client side that the file does not exist. The property TRUSTSTOREPATH in RenewalWorker can be set to any path (without any restrictions) by an admin user. In the case that the provided path points to an existing file, readable by the user running the application server, but is not a recognized PEM format, it returns this as an error to the client side, confirming the existences of the file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-25827
EUVD
EUVD-2026-78629

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
keyfactor signserver to 7.6.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-25827 is a local file enumeration vulnerability in Keyfactor SignServer versions before 7.6.0. It involves three properties that lack restrictions, allowing an admin to set file paths that reveal information to the client side. These properties can confirm the existence of files on the server, even if they are not in the expected format.

Detection Guidance

To detect this vulnerability, check if your Keyfactor SignServer version is prior to 7.6.0. Review configurations for the properties ATTRIBUTESFILE, KEYSTOREPATH, and TRUSTSTOREPATH in PKCS11CryptoToken, KeyStoreCryptoToken, and RenewalWorker respectively. Test these paths by attempting to set them to arbitrary file paths and observe if the server returns errors confirming file existence.

Impact Analysis

An attacker with admin access could exploit this to determine the existence of sensitive files on the server. This could lead to information disclosure, such as confirming the presence of configuration files, keystores, or other critical system files, potentially aiding further attacks.

Compliance Impact

This vulnerability could impact compliance by potentially exposing sensitive file paths or confirming the existence of unauthorized files, which may violate data protection requirements under GDPR or HIPAA. Unauthorized information disclosure risks non-compliance with confidentiality and security controls.

Mitigation Strategies

Upgrade Keyfactor SignServer to version 7.6.0 or later immediately. This version includes restrictions on the affected properties to prevent file enumeration. Contact support@keyfactor.com for assistance if needed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-25827. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart