CVE-2026-41880

R-SOFT DMS is vulnerable to OS Command Injection in the Optical Character Recognition (OCR) module. Multiple command execution functions accept user-controllable file paths without proper sanitization before passing them to the system shell via SSH. In current infrastructure the URL encoding neutralizes the injection during the standard web upload flow. An authenticated attacker who is able to trigger the OCR functionality for the uploaded file can execute OS commands within the context of a root user. This issue was fixed in version v3.19-2862 and v3.17-2580.

CVSS

No CVSS.

References

Link	Resource
https://cert.pl/posts/2026/07/CVE-2026-41876

Configurations

No configuration.

History

24 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) R-SOFT DMS es vulnerable a la inyección de comandos del sistema operativo en el módulo de Reconocimiento Óptico de Caracteres (OCR). Múltiples funciones de ejecución de comandos aceptan rutas de archivo controlables por el usuario sin una sanitización adecuada antes de pasarlas al shell del sistema a través de SSH. En la infraestructura actual, la codificación URL neutraliza la inyección durante el flujo estándar de carga web. Un atacante autenticado que es capaz de activar la funcionalidad OCR para el archivo cargado puede ejecutar comandos del sistema operativo dentro del contexto de un usuario root. Este problema fue solucionado en la versión v3.19-2862 y v3.17-2580.

Information

Published : 2026-07-10 10:16

Updated : 2026-10-24 23:10

NVD link : CVE-2026-41880

Mitre link : CVE-2026-41880

CVE.ORG link : CVE-2026-41880

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-41880", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41880", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-10T10:27:49.734940Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cvd@cert.pl", "affectedData": [{"vendor": "R-SOFT SERWIS", "product": "DMS", "versions": [{"status": "affected", "version": "0", "lessThan": "v3.19-2862", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "v3.17-2580", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-10T10:16:24.193", "references": [{"url": "https://cert.pl/posts/2026/07/CVE-2026-41876", "source": "cvd@cert.pl"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "R-SOFT DMS is vulnerable to\u00a0OS Command Injection in the Optical Character Recognition (OCR) module. Multiple command execution functions accept user-controllable file paths without proper sanitization before passing them to the system shell via SSH. In current infrastructure the URL encoding neutralizes the injection during the standard web upload flow. An authenticated attacker who\u00a0is able to trigger the OCR functionality for the uploaded file can execute OS commands within the context of a root user.\n\nThis issue was fixed in version\u00a0v3.19-2862\u00a0and v3.17-2580."}, {"lang": "es", "value": "R-SOFT DMS es vulnerable a la inyecci\u00f3n de comandos del sistema operativo en el m\u00f3dulo de Reconocimiento \u00d3ptico de Caracteres (OCR). M\u00faltiples funciones de ejecuci\u00f3n de comandos aceptan rutas de archivo controlables por el usuario sin una sanitizaci\u00f3n adecuada antes de pasarlas al shell del sistema a trav\u00e9s de SSH. En la infraestructura actual, la codificaci\u00f3n URL neutraliza la inyecci\u00f3n durante el flujo est\u00e1ndar de carga web. Un atacante autenticado que es capaz de activar la funcionalidad OCR para el archivo cargado puede ejecutar comandos del sistema operativo dentro del contexto de un usuario root.\n\nEste problema fue solucionado en la versi\u00f3n v3.19-2862 y v3.17-2580."}], "lastModified": "2026-10-24T23:10:00.160", "sourceIdentifier": "cvd@cert.pl"}