CVE-2026-41876

unknowncovered by 1 sourcefirst seen 2026-07-10

R-SOFT DMS is vulnerable to OS Command Injection in konwertujAction() function. The document converter executes shell commands using unsanitized file paths and format parameters. This allows an authenticated attacker to execute arbitrary system commands with the privileges of the web server user. This issue was fixed in version v3.19-2752 and v3.17-2580.

⚡ Watch CVE-2026-41876

Get an email if CVE-2026-41876 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Moderate exploitation risk1.2% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 65% of all EPSS-scored CVEs.

Advisory coverage (1)

unknownCVE-2026-41876: R-SOFT DMS is vulnerable to OS Command Injection in konwertujAction() function. The document c…nvd · 2026-07-10

External references

NVD record for CVE-2026-41876

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-41876 status](https://www.csirts.com/badge/CVE-2026-41876)](https://www.csirts.com/cve/CVE-2026-41876)