Which versions of R-SOFT DMS are affected by CVE-2026-41876?

R-SOFT DMS contains a command injection vulnerability (CVSS 8.7) in its document converter that allows authenticated users to execute arbitrary system commands as the web server process, potentially…

How to fix or mitigate CVE-2026-41876?

24 hours: Inventory all R-SOFT DMS deployments and current user access; disable document conversion functionality if not operationally critical. 7 days: Implement network segmentation to isolate R-SOFT DMS from critical systems; enable enhanced logging on file conversion activities. 30 days: Contact R-SOFT vendor for patch timeline and develop migration strategy for critical document workflows.

R-SOFT DMS CVE-2026-41876

Q: What is the CVSS score of CVE-2026-41876?

CVE-2026-41876 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.2%.

EUVD-2026-42853 HIGH

OS Command Injection (CWE-78)

2026-07-10 cvd@cert.pl

GHSA-pf8q-xpjj-9vfv

Command Injection

8.7

CVSS 4.0 · Vendor: cert

Severity by source

Vendor (cert) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (cert) · only source for this CVE.

CVSS VectorVendor: cert

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 10:33 vuln.today

DescriptionCVE.org

R-SOFT DMS is vulnerable to OS Command Injection in konwertujAction() function. The document converter executes shell commands using unsanitized file paths and format parameters. This allows an authenticated attacker to execute arbitrary system commands with the privileges of the web server user.

This issue was fixed in version v3.19-2752 and v3.17-2580.

AnalysisAI

OS command injection in R-SOFT DMS lets an authenticated user run arbitrary shell commands as the web server account by abusing the document converter. The konwertujAction() routine builds shell commands from unsanitized file-path and format parameters (CWE-78), so any user who can trigger a conversion can inject commands. …