CVE-2026-41876

Vulnerability Description

R-SOFT DMS is vulnerable to OS Command Injection in konwertujAction() function. The document converter executes shell commands using unsanitized file paths and format parameters. This allows an authenticated attacker to execute arbitrary system commands with the privileges of the web server user. This issue was fixed in version v3.19-2752 and v3.17-2580.

Related Weaknesses (CWE)

CWE-78

References

https://cert.pl/posts/2026/07/CVE-2026-41876

FAQ

What is CVE-2026-41876?

CVE-2026-41876 is a documented vulnerability. R-SOFT DMS is vulnerable to OS Command Injection in konwertujAction() function. The document converter executes shell commands using unsanitized file paths and format parameters. This allows an authen...

How severe is CVE-2026-41876?

CVSS scoring is not yet available for CVE-2026-41876. Check NVD for updates.

Is there a patch for CVE-2026-41876?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.