CVE-2026-41880

unknowncovered by 1 sourcefirst seen 2026-07-10

R-SOFT DMS is vulnerable to OS Command Injection in the Optical Character Recognition (OCR) module. Multiple command execution functions accept user-controllable file paths without proper sanitization before passing them to the system shell via SSH. In current infrastructure the URL encoding neutralizes the injection during the standard web upload flow. An authenticated attacker who is able to trigger the OCR functionality for the uploaded file can execute OS commands within the context of a root user. This issue was fixed in version v3.19-2862 and v3.17-2580.

⚡ Watch CVE-2026-41880

Get an email if CVE-2026-41880 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Moderate exploitation risk1.3% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 68% of all EPSS-scored CVEs.

Advisory coverage (1)

unknownCVE-2026-41880: R-SOFT DMS is vulnerable to OS Command Injection in the Optical Character Recognition (OCR) mo…nvd · 2026-07-10

External references

NVD record for CVE-2026-41880

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-41880 status](https://www.csirts.com/badge/CVE-2026-41880)](https://www.csirts.com/cve/CVE-2026-41880)