OS Command Injection in R-SOFT DMS

published 2026-07-10 4 mo ago modified 2026-10-24 15 d ago also EUVD-2026-42855

cvss: 9.0; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.3%; EPSS 1.3% chance of exploitation in 30 days, percentile 71%
public exploits: 0; none known

R-SOFT DMS is vulnerable to OS Command Injection in the Optical Character Recognition (OCR) module. Multiple command execution functions accept user-controllable file paths without proper sanitization before passing them to the system shell via SSH. In current infrastructure the URL encoding neutralizes the injection during the standard web upload flow. An authenticated attacker who is able to trigger the OCR functionality for the uploaded file can execute OS commands within the context of a root user.

This issue was fixed in version v3.19-2862 and v3.17-2580.

Patch / fix

fixed in 1

R-SOFT SERWIS DMS v3.17-2580, v3.19-2862

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 4 mo ago (2026-07-10)

Exploit prediction

1.33% chance of exploitation in the next 30 days, higher than 71% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	9.0	CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CNA	4.0	9.0	CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

R-SOFT SERWIS DMS

Classification

Weakness

CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

cert.pl /posts/2026/07/CVE-2026-41876
third-party-advisory

Sources

CVE List CVE-2026-41880
NVD CVE-2026-41880

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary