CVE-2026-41876

UNKNOWN 0.0

OS Command Injection in R-SOFT DMS

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

R-SOFT DMS is vulnerable to OS Command Injection in konwertujAction() function. The document converter executes shell commands using unsanitized file paths and format parameters. This allows an authenticated attacker to execute arbitrary system commands with the privileges of the web server user. This issue was fixed in version v3.19-2752 and v3.17-2580.

CWE	CWE-78
Vendor	r-soft serwis
Product	dms
Published	Jul 10, 2026
Last Updated	Jul 10, 2026

Stay Ahead of the Next One

Get instant alerts for r-soft serwis dms

Be the first to know when new unknown vulnerabilities affecting r-soft serwis dms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

R-SOFT SERWIS / DMS

0 < v3.19-2752 0 < v3.17-2580

References

NVD ↗ CVE.org ↗ EPSS Data ↗

cert.pl: https://cert.pl/posts/2026/07/CVE-2026-41876

Credits

Marek Figielski (Vanilla.pl)