R‑SOFT DMS allows an authenticated user to upload a file whose name can contain arbitrary HTML and JavaScript. After uploading, the file name is rendered in the file list or upload status views and is executed by any other user who browses those pages. This leads to execution of arbitrary client‑side code in users’ browsers. The vulnerability originates from insufficient input validation on the file name field, as identified by CWE‑79.

The R‑SOFT SERWIS DMS product is affected in releases older than v3.19‑2832 and v3.17‑2580, as the issue was fixed in those versions. All earlier releases should be considered vulnerable.

The CVSS score of 5.1 indicates moderate impact; the EPSS score of less than 1% suggests a low probability of real‑world exploitation. The flaw is not listed in the CISA KEV catalog. Exploitation requires valid authenticated credentials and the privilege to upload files; once a file name is crafted, any user who views the upload status or file list will execute the injected code.