CVE-2026-41877

UNKNOWN 0.0

Stored XSS in R-SOFT DMS

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

R-SOFT DMS is vulnerable to Stored XSS in file upload functionality. Authenticated attacker can inject arbitrary HTML and JS into the name of the file being uploaded, which will be executed when visiting file list or upload status by other users. This issue was fixed in version v3.19-2832 and v3.17-2580.

CWE	CWE-79
Vendor	r-soft serwis
Product	dms
Published	Jul 10, 2026
Last Updated	Jul 10, 2026

Stay Ahead of the Next One

Get instant alerts for r-soft serwis dms

Be the first to know when new unknown vulnerabilities affecting r-soft serwis dms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

R-SOFT SERWIS / DMS

0 < v3.19-2832 0 < v3.17-2580

References

NVD ↗ CVE.org ↗ EPSS Data ↗

cert.pl: https://cert.pl/posts/2026/07/CVE-2026-41876

Credits

Marek Figielski (Vanilla.pl)