CVE-2026-41876CWE-78

OS Command Injection in R-SOFT DMS

High · published July 10, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
68.7
In the wild
Unconfirmed
What it is

R-SOFT DMS is vulnerable to OS Command Injection in konwertujAction() function. The document converter executes shell commands using unsanitized file paths and format parameters. This allows an authenticated attacker to execute arbitrary system commands with the privileges of the web server user.

This issue was fixed in version v3.19-2752 and v3.17-2580.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
EPSS
0.01228 · 68.7th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-07-10T09:05Z
EPSS history
Timeline
  • 10 JUL 09:05Z
    OS Command Injection in R-SOFT DMS
    cvelistv5