Vulnerability · Published Jul 10, 2026 · Assigned by CERT-PL

CVE-2026-41880OS Command Injection in R-SOFT DMS

Critical 9.0

In plain English

A critical-severity OS command injection in DMS from R-SOFT SERWIS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities).

Severity (CVSS 4.0)9.0Critical

Exploit odds (30 days)1.3%top 28.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

R-SOFT DMS is vulnerable to OS Command Injection in the Optical Character Recognition (OCR) module. Multiple command execution functions accept user-controllable file paths without proper sanitization before passing them to the system shell via SSH. In current infrastructure the URL encoding neutralizes the injection during the standard web upload flow. An authenticated attacker who is able to trigger the OCR functionality for the uploaded file can execute OS commands within the context of a root user. This issue was fixed in version v3.19-2862 and v3.17-2580.

Affected products (as reported)

Vendor	Product	Versions
R-SOFT SERWIS	DMS	0 – before v3.19-28620 – before v3.17-2580

Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://cert.pl/posts/2026/07/CVE-2026-41876 third-party-advisory