Vulnerability · Published Jul 10, 2026 · Assigned by CERT-PL

CVE-2026-41876OS Command Injection in R-SOFT DMS

High 8.7

In plain English

A high-severity OS command injection in DMS from R-SOFT SERWIS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)1.2%top 31.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

R-SOFT DMS is vulnerable to OS Command Injection in konwertujAction() function. The document converter executes shell commands using unsanitized file paths and format parameters. This allows an authenticated attacker to execute arbitrary system commands with the privileges of the web server user. This issue was fixed in version v3.19-2752 and v3.17-2580.

Affected products (as reported)

Vendor	Product	Versions
R-SOFT SERWIS	DMS	0 – before v3.19-27520 – before v3.17-2580

Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

References

https://cert.pl/posts/2026/07/CVE-2026-41876 third-party-advisory