Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
4 vulnerabilities found for DigiDoc4 by Estonian Information System Authority (RIA)
CVE-2026-70383 (GCVE-0-2026-70383)
Vulnerability from nvd – Published: 2026-08-20 14:04 – Updated: 2026-08-26 19:51
VLAI
EPSS
VEX
Title
Arbitrary file overwrite vulnerability in DigiDoc4 client
Summary
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Estonian Information System Authority (RIA) DigiDoc4 client.
This issue affects DigiDoc4: from 4.0.0 before 4.11.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 19:43 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
3 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Estonian Information System Authority (RIA) | DigiDoc4 |
Affected:
4.0.0 , < 4.11.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70383",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T19:43:29.497162Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T19:51:08.117Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DigiDoc4",
"vendor": "Estonian Information System Authority (RIA)",
"versions": [
{
"lessThan": "4.11.0",
"status": "affected",
"version": "4.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Siva Aditya Panuganti, Aditya Security Labs"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in Estonian Information System Authority (RIA) DigiDoc4 client.\u003cp\u003eThis issue affects DigiDoc4: from 4.0.0 before 4.11.0.\u003c/p\u003e"
}
],
"value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in Estonian Information System Authority (RIA) DigiDoc4 client.\n\nThis issue affects DigiDoc4: from 4.0.0 before 4.11.0."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T14:04:15.480Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/open-eid/libdigidocpp/pull/736"
},
{
"tags": [
"patch"
],
"url": "https://github.com/open-eid/DigiDoc4-Client/pull/1402"
},
{
"tags": [
"product"
],
"url": "https://github.com/open-eid/DigiDoc4-Client"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Arbitrary file overwrite vulnerability in DigiDoc4 client",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-70383",
"datePublished": "2026-08-20T14:04:15.480Z",
"dateReserved": "2026-08-04T07:41:00.082Z",
"dateUpdated": "2026-08-26T19:51:08.117Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59112 (GCVE-0-2026-59112)
Vulnerability from nvd – Published: 2026-08-10 13:57 – Updated: 2026-08-10 17:55
VLAI
EPSS
VEX
Title
Signature validation vulnerability affecting DigiDoc applications
Summary
Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian Information System Authority (RIA) libdigidocpp, DigiDoc4, DigiDoc on Android, and DigiDoc on iOS. This issue affects libdigidocpp: from 4.1.0 before 4.2.1; DigiDoc4: from 4.7.0 before 4.8.2; DigiDoc on Android: from 2.7.0 before 2.7.2; DigiDoc on iOS: from 2.8.0 before 2.8.1.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-10 17:55 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/open-eid/libdigidocpp/pull/690 | patch |
| https://www.id.ee/en/article/ria-soovitab-kasutaj… | vendor-advisory |
| https://www.ria.ee/blogi/digidoc-rakendustes-esin… | government-resource |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Estonian Information System Authority (RIA) | libdigidocpp |
Affected:
4.1.0 , < 4.2.1
(semver)
|
|
| Estonian Information System Authority (RIA) | DigiDoc4 |
Affected:
4.7.0 , < 4.8.2
(semver)
|
|
| Estonian Information System Authority (RIA) | DigiDoc |
Affected:
2.7.0 , < 2.7.2
(semver)
|
|
| Estonian Information System Authority (RIA) | DigiDoc |
Affected:
2.8.0 , < 2.8.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59112",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T17:55:03.112154Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T17:55:30.587Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/open-eid/libdigidocpp/pull/690"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "libdigidocpp",
"vendor": "Estonian Information System Authority (RIA)",
"versions": [
{
"lessThan": "4.2.1",
"status": "affected",
"version": "4.1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DigiDoc4",
"vendor": "Estonian Information System Authority (RIA)",
"versions": [
{
"lessThan": "4.8.2",
"status": "affected",
"version": "4.7.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Android"
],
"product": "DigiDoc",
"vendor": "Estonian Information System Authority (RIA)",
"versions": [
{
"lessThan": "2.7.2",
"status": "affected",
"version": "2.7.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"iOS"
],
"product": "DigiDoc",
"vendor": "Estonian Information System Authority (RIA)",
"versions": [
{
"lessThan": "2.8.1",
"status": "affected",
"version": "2.8.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Burak Can Kus \u0026 Aleksander Kamenik (Cybernetica)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian Information System Authority (RIA) libdigidocpp, DigiDoc4, DigiDoc on Android, and DigiDoc on iOS.\u0026nbsp;This issue affects libdigidocpp: from 4.1.0 before 4.2.1; DigiDoc4: from 4.7.0 before 4.8.2; DigiDoc on Android: from 2.7.0 before 2.7.2; DigiDoc on iOS: from 2.8.0 before 2.8.1."
}
],
"value": "Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian Information System Authority (RIA) libdigidocpp, DigiDoc4, DigiDoc on Android, and DigiDoc on iOS.\u00a0This issue affects libdigidocpp: from 4.1.0 before 4.2.1; DigiDoc4: from 4.7.0 before 4.8.2; DigiDoc on Android: from 2.7.0 before 2.7.2; DigiDoc on iOS: from 2.8.0 before 2.8.1."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"exploitMaturity": "PROOF_OF_CONCEPT",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347 Improper verification of cryptographic signature",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-754",
"description": "CWE-754: Improper Check for Unusual or Exceptional Conditions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T13:57:37.159Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/open-eid/libdigidocpp/pull/690"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.id.ee/en/article/ria-soovitab-kasutajatel-uuendada-id-tarkvara-eng/"
},
{
"tags": [
"government-resource"
],
"url": "https://www.ria.ee/blogi/digidoc-rakendustes-esinenud-turvanorkus-mis-juhtus-ja-kuidas-see-parandati"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eSystems integrating libdigidocpp should update to\nversion 4.2.1 or later.\u0026nbsp;\u003cbr\u003eUsers of DigiDoc applications should update to fixed\nversions provided by the vendor:\u0026nbsp;\u003cbr\u003eDigiDoc4 - 4.8.2 or later, RIA DigiDoc Android\n- 2.7.2 or later, and RIA DigiDoc iOS - 2.8.1 or later.\u0026nbsp;\u003cbr\u003eSignatures that were validated\nwith the vulnerable software versions should be revalidated.\u003c/span\u003e"
}
],
"value": "Systems integrating libdigidocpp should update to\nversion 4.2.1 or later.\u00a0\nUsers of DigiDoc applications should update to fixed\nversions provided by the vendor:\u00a0\nDigiDoc4 - 4.8.2 or later, RIA DigiDoc Android\n- 2.7.2 or later, and RIA DigiDoc iOS - 2.8.1 or later.\u00a0\nSignatures that were validated\nwith the vulnerable software versions should be revalidated."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Signature validation vulnerability affecting DigiDoc applications",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-59112",
"datePublished": "2026-08-10T13:57:37.159Z",
"dateReserved": "2026-07-02T15:47:36.965Z",
"dateUpdated": "2026-08-10T17:55:30.587Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-70383 (GCVE-0-2026-70383)
Vulnerability from cvelistv5 – Published: 2026-08-20 14:04 – Updated: 2026-08-26 19:51
VLAI
EPSS
VEX
Title
Arbitrary file overwrite vulnerability in DigiDoc4 client
Summary
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Estonian Information System Authority (RIA) DigiDoc4 client.
This issue affects DigiDoc4: from 4.0.0 before 4.11.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 19:43 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
3 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Estonian Information System Authority (RIA) | DigiDoc4 |
Affected:
4.0.0 , < 4.11.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-70383",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T19:43:29.497162Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T19:51:08.117Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "DigiDoc4",
"vendor": "Estonian Information System Authority (RIA)",
"versions": [
{
"lessThan": "4.11.0",
"status": "affected",
"version": "4.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Siva Aditya Panuganti, Aditya Security Labs"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in Estonian Information System Authority (RIA) DigiDoc4 client.\u003cp\u003eThis issue affects DigiDoc4: from 4.0.0 before 4.11.0.\u003c/p\u003e"
}
],
"value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in Estonian Information System Authority (RIA) DigiDoc4 client.\n\nThis issue affects DigiDoc4: from 4.0.0 before 4.11.0."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T14:04:15.480Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/open-eid/libdigidocpp/pull/736"
},
{
"tags": [
"patch"
],
"url": "https://github.com/open-eid/DigiDoc4-Client/pull/1402"
},
{
"tags": [
"product"
],
"url": "https://github.com/open-eid/DigiDoc4-Client"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Arbitrary file overwrite vulnerability in DigiDoc4 client",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-70383",
"datePublished": "2026-08-20T14:04:15.480Z",
"dateReserved": "2026-08-04T07:41:00.082Z",
"dateUpdated": "2026-08-26T19:51:08.117Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59112 (GCVE-0-2026-59112)
Vulnerability from cvelistv5 – Published: 2026-08-10 13:57 – Updated: 2026-08-10 17:55
VLAI
EPSS
VEX
Title
Signature validation vulnerability affecting DigiDoc applications
Summary
Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian Information System Authority (RIA) libdigidocpp, DigiDoc4, DigiDoc on Android, and DigiDoc on iOS. This issue affects libdigidocpp: from 4.1.0 before 4.2.1; DigiDoc4: from 4.7.0 before 4.8.2; DigiDoc on Android: from 2.7.0 before 2.7.2; DigiDoc on iOS: from 2.8.0 before 2.8.1.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-10 17:55 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/open-eid/libdigidocpp/pull/690 | patch |
| https://www.id.ee/en/article/ria-soovitab-kasutaj… | vendor-advisory |
| https://www.ria.ee/blogi/digidoc-rakendustes-esin… | government-resource |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Estonian Information System Authority (RIA) | libdigidocpp |
Affected:
4.1.0 , < 4.2.1
(semver)
|
|
| Estonian Information System Authority (RIA) | DigiDoc4 |
Affected:
4.7.0 , < 4.8.2
(semver)
|
|
| Estonian Information System Authority (RIA) | DigiDoc |
Affected:
2.7.0 , < 2.7.2
(semver)
|
|
| Estonian Information System Authority (RIA) | DigiDoc |
Affected:
2.8.0 , < 2.8.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59112",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T17:55:03.112154Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T17:55:30.587Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/open-eid/libdigidocpp/pull/690"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "libdigidocpp",
"vendor": "Estonian Information System Authority (RIA)",
"versions": [
{
"lessThan": "4.2.1",
"status": "affected",
"version": "4.1.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "DigiDoc4",
"vendor": "Estonian Information System Authority (RIA)",
"versions": [
{
"lessThan": "4.8.2",
"status": "affected",
"version": "4.7.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Android"
],
"product": "DigiDoc",
"vendor": "Estonian Information System Authority (RIA)",
"versions": [
{
"lessThan": "2.7.2",
"status": "affected",
"version": "2.7.0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"iOS"
],
"product": "DigiDoc",
"vendor": "Estonian Information System Authority (RIA)",
"versions": [
{
"lessThan": "2.8.1",
"status": "affected",
"version": "2.8.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Burak Can Kus \u0026 Aleksander Kamenik (Cybernetica)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian Information System Authority (RIA) libdigidocpp, DigiDoc4, DigiDoc on Android, and DigiDoc on iOS.\u0026nbsp;This issue affects libdigidocpp: from 4.1.0 before 4.2.1; DigiDoc4: from 4.7.0 before 4.8.2; DigiDoc on Android: from 2.7.0 before 2.7.2; DigiDoc on iOS: from 2.8.0 before 2.8.1."
}
],
"value": "Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian Information System Authority (RIA) libdigidocpp, DigiDoc4, DigiDoc on Android, and DigiDoc on iOS.\u00a0This issue affects libdigidocpp: from 4.1.0 before 4.2.1; DigiDoc4: from 4.7.0 before 4.8.2; DigiDoc on Android: from 2.7.0 before 2.7.2; DigiDoc on iOS: from 2.8.0 before 2.8.1."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"exploitMaturity": "PROOF_OF_CONCEPT",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347 Improper verification of cryptographic signature",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-754",
"description": "CWE-754: Improper Check for Unusual or Exceptional Conditions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T13:57:37.159Z",
"orgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"shortName": "ENISA"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/open-eid/libdigidocpp/pull/690"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.id.ee/en/article/ria-soovitab-kasutajatel-uuendada-id-tarkvara-eng/"
},
{
"tags": [
"government-resource"
],
"url": "https://www.ria.ee/blogi/digidoc-rakendustes-esinenud-turvanorkus-mis-juhtus-ja-kuidas-see-parandati"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eSystems integrating libdigidocpp should update to\nversion 4.2.1 or later.\u0026nbsp;\u003cbr\u003eUsers of DigiDoc applications should update to fixed\nversions provided by the vendor:\u0026nbsp;\u003cbr\u003eDigiDoc4 - 4.8.2 or later, RIA DigiDoc Android\n- 2.7.2 or later, and RIA DigiDoc iOS - 2.8.1 or later.\u0026nbsp;\u003cbr\u003eSignatures that were validated\nwith the vulnerable software versions should be revalidated.\u003c/span\u003e"
}
],
"value": "Systems integrating libdigidocpp should update to\nversion 4.2.1 or later.\u00a0\nUsers of DigiDoc applications should update to fixed\nversions provided by the vendor:\u00a0\nDigiDoc4 - 4.8.2 or later, RIA DigiDoc Android\n- 2.7.2 or later, and RIA DigiDoc iOS - 2.8.1 or later.\u00a0\nSignatures that were validated\nwith the vulnerable software versions should be revalidated."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Signature validation vulnerability affecting DigiDoc applications",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "a6d3dc9e-0591-4a13-bce7-0f5b31ff6158",
"assignerShortName": "ENISA",
"cveId": "CVE-2026-59112",
"datePublished": "2026-08-10T13:57:37.159Z",
"dateReserved": "2026-07-02T15:47:36.965Z",
"dateUpdated": "2026-08-10T17:55:30.587Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}