CVE-2026-41876

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41876", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "state": "PUBLISHED", "assignerShortName": "CERT-PL", "dateReserved": "2026-04-22T11:32:15.204Z", "datePublished": "2026-07-10T09:05:07.027Z", "dateUpdated": "2026-07-10T10:57:21.972Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-07-10T09:05:07.027Z"}, "title": "OS Command Injection in R-SOFT DMS", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88 OS Command Injection"}]}], "affected": [{"vendor": "R-SOFT SERWIS", "product": "DMS", "versions": [{"status": "affected", "version": "0", "lessThan": "v3.19-2752", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "v3.17-2580", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "R-SOFT DMS is vulnerable to\u00a0OS Command Injection in konwertujAction() function.\u00a0The document converter executes shell commands using unsanitized file paths and format parameters.\u00a0This allows an authenticated attacker to execute arbitrary system commands with the privileges of the web server user.\n\nThis issue was fixed in version\u00a0v3.19-2752 and v3.17-2580.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "R-SOFT DMS is vulnerable to&nbsp;OS Command Injection in konwertujAction() function.&nbsp;The document converter executes shell commands using unsanitized file paths and format parameters.&nbsp;This allows an authenticated attacker to execute arbitrary system commands with the privileges of the web server user.<br><br>This issue was fixed in version&nbsp;v3.19-2752 and v3.17-2580."}]}], "references": [{"url": "https://cert.pl/posts/2026/07/CVE-2026-41876", "tags": ["third-party-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "LOW", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.7, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L"}}], "credits": [{"lang": "en", "value": "Marek Figielski (Vanilla.pl)", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-10T10:57:08.498105Z", "id": "CVE-2026-41876", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-10T10:57:21.972Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41876", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-10T10:57:08.498105Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-10T10:57:17.549Z"}}], "cna": {"title": "OS Command Injection in R-SOFT DMS", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Marek Figielski (Vanilla.pl)"}], "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88 OS Command Injection"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "R-SOFT SERWIS", "product": "DMS", "versions": [{"status": "affected", "version": "0", "lessThan": "v3.19-2752", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "v3.17-2580", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://cert.pl/posts/2026/07/CVE-2026-41876", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "R-SOFT DMS is vulnerable to\u00a0OS Command Injection in konwertujAction() function.\u00a0The document converter executes shell commands using unsanitized file paths and format parameters.\u00a0This allows an authenticated attacker to execute arbitrary system commands with the privileges of the web server user.\n\nThis issue was fixed in version\u00a0v3.19-2752 and v3.17-2580.", "supportingMedia": [{"type": "text/html", "value": "R-SOFT DMS is vulnerable to&nbsp;OS Command Injection in konwertujAction() function.&nbsp;The document converter executes shell commands using unsanitized file paths and format parameters.&nbsp;This allows an authenticated attacker to execute arbitrary system commands with the privileges of the web server user.<br><br>This issue was fixed in version&nbsp;v3.19-2752 and v3.17-2580.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-07-10T09:05:07.027Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41876", "state": "PUBLISHED", "dateUpdated": "2026-07-10T10:57:21.972Z", "dateReserved": "2026-04-22T11:32:15.204Z", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "datePublished": "2026-07-10T09:05:07.027Z", "assignerShortName": "CERT-PL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "DMS", "vendor": "R-SOFT SERWIS", "versions": [{"lessThan": "v3.19-2752", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "v3.17-2580", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "cvd@cert.pl"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "R-SOFT DMS is vulnerable to\u00a0OS Command Injection in konwertujAction() function.\u00a0The document converter executes shell commands using unsanitized file paths and format parameters.\u00a0This allows an authenticated attacker to execute arbitrary system commands with the privileges of the web server user.\n\nThis issue was fixed in version\u00a0v3.19-2752 and v3.17-2580."}, {"lang": "es", "value": "R-SOFT DMS es vulnerable a inyecci\u00f3n de comandos del sistema operativo en la funci\u00f3n konwertujAction(). El conversor de documentos ejecuta comandos de shell utilizando rutas de archivo no saneadas y par\u00e1metros de formato. Esto permite a un atacante autenticado ejecutar comandos de sistema arbitrarios con los privilegios del usuario del servidor web.\n\nEste problema fue solucionado en la versi\u00f3n v3.19-2752 y v3.17-2580."}], "id": "CVE-2026-41876", "lastModified": "2026-10-25T15:10:00.147", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cvd@cert.pl", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41876", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-10T10:57:08.498105Z", "version": "2.0.3"}}]}, "published": "2026-07-10T10:16:23.687", "references": [{"source": "cvd@cert.pl", "url": "https://cert.pl/posts/2026/07/CVE-2026-41876"}], "sourceIdentifier": "cvd@cert.pl", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "cvd@cert.pl", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,v3.19-2752)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,v3.17-2580)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "DMS", "source": "cna", "vendor": "R-SOFT SERWIS"}, "product": "dms", "vendor": "r-soft_serwis"}], "created": "2026-07-11T11:30:05.891239+00:00", "updated": "2026-08-01T13:15:03.223228+00:00", "vendors": ["r-soft_serwis", "r-soft_serwis$PRODUCT$dms"]}