CVE-2026-25825

An issue was discovered in Keyfactor SignServer before 7.6.0. The output file to which SignerStatusReportWorker logs the report can be set to any path, even one that points to a file that already exists. This gives a user (with admin access) the possibility to write files in arbitrary directories in the server filesystem and potentially overwrite files accessible by the local user JBoss.

• Published Sep 15, 2026
• CVSS 2.7 low
• 0.3% chance of exploitation in the next 30 days (EPSS)
• A fix is available

CVE-2026-25825 at the National Vulnerability Database