EUVD-2026-42854
GHSA-c9ph-5j66-3j9f
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated low-privilege attacker (PR:L), passive victim must view the affected page (UI:R), stored XSS crosses into victim browser session constituting scope change (S:C), with limited confidentiality and integrity impact.
Primary rating from Vendor (cert).
CVSS VectorVendor: cert
Lifecycle Timeline
1DescriptionCVE.org
R-SOFT DMS is vulnerable to Stored XSS in file upload functionality. Authenticated attacker can inject arbitrary HTML and JS into the name of the file being uploaded, which will be executed when visiting file list or upload status by other users.
This issue was fixed in version v3.19-2832 and v3.17-2580.
AnalysisAI
Stored XSS in R-SOFT DMS file upload functionality allows authenticated attackers to embed arbitrary HTML and JavaScript within uploaded filenames, which subsequently execute in the browsers of any user viewing the file list or upload status pages. The vulnerability affects the document management system's filename rendering pipeline, which fails to sanitize input before output into HTML context. Fixed versions are available (v3.19-2832 and v3.17-2580); no public exploit identified at time of analysis, and the product is not listed in the CISA KEV catalog.
Technical ContextAI
R-SOFT DMS is a document management system (DMS) with a file upload feature that stores and displays user-supplied filenames. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), stored variant: the application persists unsanitized filename strings to a data store and reflects them unescaped into HTML page output when other users view file listings or upload status screens. No CPE strings were provided in the source data. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) confirms the attack is network-delivered, low-complexity, requires low-privilege authentication on the part of the attacker, and passive victim interaction (simply visiting the affected page). Scope change to subsequent systems (SC:L/SI:L) indicates the injected script executes in the victim's browser session rather than the server itself.
RemediationAI
Upgrade R-SOFT DMS to version v3.19-2832 (on the 3.19 branch) or v3.17-2580 (on the 3.17 branch), as confirmed in the CVE description. Consult the CERT Poland advisory at https://cert.pl/posts/2026/07/CVE-2026-41876 for additional guidance. If immediate patching is not feasible, restrict access to the file upload and file listing features to the minimum set of trusted, internal users as a compensating control - this reduces the attacker pool but does not eliminate the vulnerability for insider-threat scenarios. Additionally, deploying a Content Security Policy (CSP) header that disallows inline script execution can prevent injected JavaScript from running even if the XSS payload is stored; this has no functional side effects on typical DMS page rendering unless the application itself relies on inline scripts.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today