CVE-2026-41880: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in R-SOFT SERWIS DMS
R-SOFT DMS is vulnerable to OS Command Injection in the Optical Character Recognition (OCR) module. Multiple command execution functions accept user-controllable file paths without proper sanitization before passing them to the system shell via SSH. In current infrastructure the URL encoding neutralizes the injection during the standard web upload flow. An authenticated attacker who is able to trigger the OCR functionality for the uploaded file can execute OS commands within the context of a root user. This issue was fixed in version v3.19-2862 and v3.17-2580.
AI Analysis
Technical Summary
CVE-2026-41880 is an OS Command Injection vulnerability (CWE-78) in the Optical Character Recognition (OCR) module of R-SOFT SERWIS DMS. Multiple command execution functions accept user-controlled file paths without adequate sanitization before passing them to the system shell via SSH. While URL encoding mitigates injection in the standard web upload flow, an authenticated attacker able to trigger OCR processing on an uploaded file can execute arbitrary OS commands with root privileges. The vulnerability is resolved in versions v3.19-2862 and v3.17-2580.
Potential Impact
An authenticated attacker can execute arbitrary OS commands as the root user on the affected system by exploiting the OCR functionality with crafted file paths. This can lead to full system compromise, data theft, or disruption of service. The vulnerability has a CVSS 4.0 base score of 9, indicating critical severity.
Mitigation Recommendations
The vulnerability is fixed in R-SOFT SERWIS DMS versions v3.19-2862 and v3.17-2580. Users should upgrade to these versions or later to remediate the issue. No other official remediation or temporary fixes are documented. Until patched, restricting access to the OCR functionality and ensuring only trusted users can upload files may reduce risk.
CVE-2026-41880: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in R-SOFT SERWIS DMS
Description
R-SOFT DMS is vulnerable to OS Command Injection in the Optical Character Recognition (OCR) module. Multiple command execution functions accept user-controllable file paths without proper sanitization before passing them to the system shell via SSH. In current infrastructure the URL encoding neutralizes the injection during the standard web upload flow. An authenticated attacker who is able to trigger the OCR functionality for the uploaded file can execute OS commands within the context of a root user. This issue was fixed in version v3.19-2862 and v3.17-2580.
CVSS v4.0
Score 9.0critical
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-41880 is an OS Command Injection vulnerability (CWE-78) in the Optical Character Recognition (OCR) module of R-SOFT SERWIS DMS. Multiple command execution functions accept user-controlled file paths without adequate sanitization before passing them to the system shell via SSH. While URL encoding mitigates injection in the standard web upload flow, an authenticated attacker able to trigger OCR processing on an uploaded file can execute arbitrary OS commands with root privileges. The vulnerability is resolved in versions v3.19-2862 and v3.17-2580.
Potential Impact
An authenticated attacker can execute arbitrary OS commands as the root user on the affected system by exploiting the OCR functionality with crafted file paths. This can lead to full system compromise, data theft, or disruption of service. The vulnerability has a CVSS 4.0 base score of 9, indicating critical severity.
Mitigation Recommendations
The vulnerability is fixed in R-SOFT SERWIS DMS versions v3.19-2862 and v3.17-2580. Users should upgrade to these versions or later to remediate the issue. No other official remediation or temporary fixes are documented. Until patched, restricting access to the OCR functionality and ensuring only trusted users can upload files may reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CERT-PL
- Date Reserved
- 2026-04-22T11:32:15.204Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a50c6ec68715ace436a3dfa
Added to database: 07/10/2026, 10:18:20 UTC
Last enriched: 07/10/2026, 10:32:26 UTC
Last updated: 07/10/2026, 11:18:12 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.