Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-41876

OS Command Injection in R-SOFT DMS

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
CERT-PL

Description

R-SOFT DMS is vulnerable to OS Command Injection in konwertujAction() function. The document converter executes shell commands using unsanitized file paths and format parameters. This allows an authenticated attacker to execute arbitrary system commands with the privileges of the web server user. This issue was fixed in version v3.19-2752 and v3.17-2580.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

R-SOFT SERWIS DMS

Default version status: unaffected

  • 0 to < v3.19-2752affected
  • 0 to < v3.17-2580affected

References