Description
R-SOFT DMS is vulnerable to OS Command Injection in the Optical Character Recognition (OCR) module. Multiple command execution functions accept user-controllable file paths without proper sanitization before passing them to the system shell via SSH. In current infrastructure the URL encoding neutralizes the injection during the standard web upload flow. An authenticated attacker who is able to trigger the OCR functionality for the uploaded file can execute OS commands within the context of a root user.

This issue was fixed in version v3.19-2862 and v3.17-2580.
Published: 2026-07-10
Score: 9 Critical
EPSS: 1.0% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability allows an attacker to insert arbitrary operating‑system commands into the OCR module of R‑SOFT DMS. File paths supplied to command‑execution functions are forwarded unvalidated to the system shell via SSH, letting a payload be executed with the privileges of the root user. This flaw can be leveraged to run any code on the host system, potentially giving full control of the compromised instance.

Affected Systems

Vendors affected include R‑SOFT SERWIS:DMS. Versions released before v3.19‑2862 for the 3.19 line and before v3.17‑2580 for the 3.17 line contain the flaw; later releases contain the fix.

Risk and Exploitability

The CVSS score of 9 indicates critical severity. An EPSS value of 1% suggests a low but non‑zero probability of exploitation, and the flaw is not yet listed in the CISA KEV catalog. The attack requires authentication and the ability to trigger the OCR processing on an uploaded file, implying that insider or compromised user credentials can lead to successful exploitation.

Generated by OpenCVE AI on July 29, 2026 at 11:07 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade R‑SOFT DMS to v3.19‑2862 or v3.17‑2580 or newer
  • Restrict access to the OCR feature so only trusted users can invoke it
  • Ensure that any file paths processed by the OCR module are validated and sanitized before invoking system commands

Generated by OpenCVE AI on July 29, 2026 at 11:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 13 Jul 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared R-soft Serwis
R-soft Serwis dms
Vendors & Products R-soft Serwis
R-soft Serwis dms

Fri, 10 Jul 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 10 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
Description R-SOFT DMS is vulnerable to OS Command Injection in the Optical Character Recognition (OCR) module. Multiple command execution functions accept user-controllable file paths without proper sanitization before passing them to the system shell via SSH. In current infrastructure the URL encoding neutralizes the injection during the standard web upload flow. An authenticated attacker who is able to trigger the OCR functionality for the uploaded file can execute OS commands within the context of a root user. This issue was fixed in version v3.19-2862 and v3.17-2580.
Title OS Command Injection in R-SOFT DMS
Weaknesses CWE-78
References
Metrics cvssV4_0

{'score': 9, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Subscriptions

R-soft Serwis Dms
cve-icon MITRE

Status: PUBLISHED

Assigner: CERT-PL

Published:

Updated: 2026-07-10T10:55:59.746Z

Reserved: 2026-04-22T11:32:15.204Z

Link: CVE-2026-41880

cve-icon Vulnrichment

Updated: 2026-07-10T10:27:54.732Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-29T11:15:04Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')