Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

R-SOFT DMS allows attackers to run system commands

CVE-2026-41876 · published 3 months ago
Summary

An attacker with a valid login can execute system commands on your server, potentially allowing them to access or modify sensitive data. This is a serious issue that can be exploited if you're using an outdated version of R-SOFT DMS. To fix this, update to version 3.19-2752 or 3.17-2580.

What to do
  • Update r-soft serwis dms to version v3.19-2752 or later.
Affected software
VendorProductAffected versions
r-soft serwis dms < v3.19-2752
Original advisory text
R-SOFT DMS is vulnerable to OS Command Injection in konwertujAction() function. The document converter executes shell commands using unsanitized file paths and format parameters. This allows an aut...
R-SOFT DMS is vulnerable to OS Command Injection in konwertujAction() function. The document converter executes shell commands using unsanitized file paths and format parameters. This allows an authenticated attacker to execute arbitrary system commands with the privileges of the web server user.

This issue was fixed in version v3.19-2752 and v3.17-2580.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.7 High
Exploitation
1% chance of attack within 30 days
Type
CWE-78OS Command Injection
Timeline
Published10 Jul 2026
Updated4 Nov 2026
First seen10 Jul 2026
Sources
CVE-2026-41876 · NVD
CVE-2026-41876 · MITRE
Track software like this
Free during beta