R‑SOFT DMS allows an authenticated user to upload a file whose name can contain arbitrary HTML and JavaScript. After uploading, the file name is rendered in the file list or upload status views and is executed by any other user who browses those pages. This stored XSS flaw can lead to client‑side script execution, enabling session hijacking, credential theft, or injection of malicious content into the user’s browser. The vulnerability arises from insufficient input validation on the file name field, as identified by CWE‑79.

The R‑SOFT SERWIS DMS product is affected in releases older than v3.19‑2832 and v3.17‑2580, as the issue was fixed in those versions. All earlier releases should be considered vulnerable.

The CVSS score of 5.1 indicates moderate impact; the EPSS score of less than 1% suggests a low probability of real‑world exploitation, and the flaw is not listed in the CISA KEV catalog. Exploitation requires valid authenticated credentials and privilege to upload files, but once an attacker controls a file name, any user who views the upload status or file list will execute the injected code. The attack vector is internal or, if an attacker obtains credentials, it can affect multiple users within the same instance.