# CVE-2026-41877: R-SOFT DMS stored XSS in file upload functionality

Source: https://junglewise.ai/threats/cve-2026-41877-r-soft-dms-stored-xss-in-file-upload-functionality  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-41877 · Severity: info · CVSS 5.1 · Published 2026-07-10

R-SOFT DMS, a document management system, contains a security flaw in its file upload feature. An authorized user can upload a file with a malicious name containing computer code. When other users or administrators view the file list, this code automatically runs in their browser, potentially allowing the attacker to steal session information or perform actions on behalf of other users.

Technologies: [R-SOFT SERWIS DMS](https://junglewise.ai/threats/technologies/dms). Vendors: [R-SOFT SERWIS](https://junglewise.ai/threats/vendors/r-soft-serwis).

## Quick answers

**Is CVE-2026-41877 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41877 being exploited in the wild.

**How severe is CVE-2026-41877?** Informational severity, with a CVSS score of 5.1, published 10 July 2026.

**Which products and versions are affected?** R-SOFT SERWIS DMS versions before v3.19-2832 and v3.17-2580.

**Is there a fix for CVE-2026-41877?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-41877 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-41877?** Check whether you run R-SOFT SERWIS DMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in R-SOFT DMS within the file upload module. The application fails to properly sanitize the filename parameter before storing it and subsequently rendering it in the web interface. An authenticated attacker can upload a file with a crafted name containing a JavaScript payload. This payload executes in the context of any user who views the file list or upload status pages. The vulnerability is addressed in versions v3.19-2832 and v3.17-2580.

## Affected products

- R-SOFT SERWIS DMS versions before v3.19-2832 and v3.17-2580

## Timeline

- 2026-07-10: disclosed
- 2026-07-10: advisory

## References

- [https://cert.pl/posts/2026/07/CVE-2026-41876](https://cert.pl/posts/2026/07/CVE-2026-41876)

## Related threats

- [R-SOFT DMS OS command injection in OCR module](https://junglewise.ai/threats/cve-2026-41880-r-soft-dms-os-command-injection-in-ocr-module)
- [R-SOFT DMS weak password hashing for superadmin credentials](https://junglewise.ai/threats/cve-2026-41879-r-soft-dms-weak-password-hashing-for-superadmin-credentials)
- [R-SOFT DMS IDOR in file download endpoints](https://junglewise.ai/threats/cve-2026-41878-r-soft-dms-idor-in-file-download-endpoints)
- [R-SOFT DMS OS command injection in konwertujAction](https://junglewise.ai/threats/cve-2026-41876-r-soft-dms-os-command-injection-in-konwertujaction)