CVE-2026-41876

Severity CVSS v4.0:

HIGH

Type:

CWE-78 OS Command Injections

Publication date:

10/07/2026

Last modified:

10/07/2026

Description

R-SOFT DMS is vulnerable to OS Command Injection in konwertujAction() function. The document converter executes shell commands using unsanitized file paths and format parameters. This allows an authenticated attacker to execute arbitrary system commands with the privileges of the web server user.<br /> <br /> This issue was fixed in version v3.19-2752 and v3.17-2580.

Impact

Vector 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L CVSS v4.0 Severity and Metrics:

Base Score: 8.70 HIGH
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Attack Vector (AV): Network
Attack Complexity (AC): Low
Attack Requirements (AT): None
Privileges Required (PR): Low
User Interaction (UI): None
Confidentiality (VC): High
Integrity (VI): High
Availability (VA): High
Confidentiality (SC): Low
Integrity (SI): Low
Availability (SA): Low

Base Score 4.0

8.70

Severity 4.0

HIGH

References to Advisories, Solutions, and Tools

https://cert.pl/posts/2026/07/CVE-2026-41876