CVE-2026-41876 PUBLISHED

OS Command Injection in R-SOFT DMS

Assigner: CERT-PL
Reserved: 22.04.2026 Published: 10.07.2026 Updated: 10.07.2026

R-SOFT DMS is vulnerable to OS Command Injection in konwertujAction() function. The document converter executes shell commands using unsanitized file paths and format parameters. This allows an authenticated attacker to execute arbitrary system commands with the privileges of the web server user.

This issue was fixed in version v3.19-2752 and v3.17-2580.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
CVSS Score: 8.7

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	Low
Attack Complexity	Low	Integrity	High	Integrity	Low
Attack Requirements	None	Availability	High	Availability	Low
Privileges Required	Low
User Interaction	None

CVSS 4.0

Product Status

Vendor	R-SOFT SERWIS
Product	DMS
Versions	Default: unaffected affected from 0 to v3.19-2752 (excl.) affected from 0 to v3.17-2580 (excl.)

Credits

Marek Figielski (Vanilla.pl) finder

References

https://cert.pl/posts/2026/07/CVE-2026-41876

Problem Types

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE

Impacts

CAPEC-88 OS Command Injection