# CVE-2026-41880: R-SOFT DMS OS command injection in OCR module

Source: https://junglewise.ai/threats/cve-2026-41880-r-soft-dms-os-command-injection-in-ocr-module  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-41880 · Severity: info · CVSS 9 · Published 2026-07-10

R-SOFT DMS, a document management system, contains a security flaw in its Optical Character Recognition (OCR) module. An authenticated user can exploit this flaw to execute unauthorized commands on the underlying server with the highest possible privileges (root). This could lead to a total system takeover, theft of all stored documents, or permanent disruption of the service.

Technologies: [R-SOFT SERWIS DMS](https://junglewise.ai/threats/technologies/dms). Vendors: [R-SOFT SERWIS](https://junglewise.ai/threats/vendors/r-soft-serwis).

## Quick answers

**Is CVE-2026-41880 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41880 being exploited in the wild.

**How severe is CVE-2026-41880?** Informational severity, with a CVSS score of 9, published 10 July 2026.

**Which products and versions are affected?** R-SOFT SERWIS DMS All versions prior to v3.19-2862 and v3.17-2580.

**Is there a fix for CVE-2026-41880?** A patch was published on 2026-07-10: Fixes released in versions v3.19-2862 and v3.17-2580 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41880 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-41880?** Check whether you run R-SOFT SERWIS DMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

R-SOFT DMS is vulnerable to OS command injection within its Optical Character Recognition (OCR) module. The vulnerability exists because multiple functions responsible for command execution accept user-controllable file paths and pass them to the system shell via SSH without adequate sanitization. While standard web upload flows may neutralize the injection via URL encoding, an authenticated attacker who can trigger the OCR process on a specially crafted file path can achieve arbitrary code execution. Successful exploitation grants the attacker root-level privileges on the host system. The issue is resolved in versions v3.19-2862 and v3.17-2580.

## Affected products

- R-SOFT SERWIS DMS All versions prior to v3.19-2862 and v3.17-2580

## Timeline

- 2026-07-10: advisory: Advisory published by CERT.PL and NVD
- 2026-07-10: patched: Fixes released in versions v3.19-2862 and v3.17-2580

## References

- [https://cert.pl/posts/2026/07/CVE-2026-41876](https://cert.pl/posts/2026/07/CVE-2026-41876)

## Related threats

- [R-SOFT DMS weak password hashing for superadmin credentials](https://junglewise.ai/threats/cve-2026-41879-r-soft-dms-weak-password-hashing-for-superadmin-credentials)
- [R-SOFT DMS IDOR in file download endpoints](https://junglewise.ai/threats/cve-2026-41878-r-soft-dms-idor-in-file-download-endpoints)
- [R-SOFT DMS stored XSS in file upload functionality](https://junglewise.ai/threats/cve-2026-41877-r-soft-dms-stored-xss-in-file-upload-functionality)
- [R-SOFT DMS OS command injection in konwertujAction](https://junglewise.ai/threats/cve-2026-41876-r-soft-dms-os-command-injection-in-konwertujaction)