CVE-2026-41880

OS Command Injection in R-SOFT DMS

Assigner: CERT-PL
Reserved: 22.04.2026 Published: 10.07.2026 Updated: 10.07.2026

R-SOFT DMS is vulnerable to OS Command Injection in the Optical Character Recognition (OCR) module. Multiple command execution functions accept user-controllable file paths without proper sanitization before passing them to the system shell via SSH. In current infrastructure the URL encoding neutralizes the injection during the standard web upload flow. An authenticated attacker who is able to trigger the OCR functionality for the uploaded file can execute OS commands within the context of a root user.

This issue was fixed in version v3.19-2862 and v3.17-2580.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS Score: 9

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	High
Attack Complexity	High	Integrity	High	Integrity	High
Attack Requirements	None	Availability	High	Availability	High
Privileges Required	Low
User Interaction	None

CVSS 4.0

Product Status

Vendor	R-SOFT SERWIS
Product	DMS
Versions	Default: unaffected affected from 0 to v3.19-2862 (excl.) affected from 0 to v3.17-2580 (excl.)

Vendor

R-SOFT SERWIS

Product

DMS

Versions

Default: unaffected

affected from 0 to v3.19-2862 (excl.)
affected from 0 to v3.17-2580 (excl.)

Credits

Marek Figielski (Vanilla.pl) finder

References

Problem Types

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE

Impacts

CAPEC-248 Command Injection