CVE-2025-47221: Keyfactor Signserver

Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days.

An arbitrary file write was found in Keyfactor SignServer versions prior to 7.3.2. The properties ARCHIVETODISK_FILENAME-PATTERN, ARCHIVETODISK_PATH_BASE, ARCHIVETODISK_PATH_PATTERN can be set to any path, even ones that will point to files that already exist. This vulnerability gives a user with admin access the possibility to write files in arbitrary directories in the server file system and potentially overwrite files accessible by the local user JBoss.

Affected products

• Keyfactor Signserver: before 7.3.1 (fixed in 7.3.1)

Published 2025-11-13. Last modified 2026-06-17.