CVE-2026-41880: R-SOFT DMS is vulnerable to OS Command Injection in the Optical Character Recognition (OCR) module

This month

CRITICAL 9.0

CVE-2026-41880 is a critical-severity flaw (CVSS 9.0) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

R-SOFT DMS is vulnerable to OS Command Injection in the Optical Character Recognition (OCR) module. Multiple command execution functions accept user-controllable file paths without proper sanitization before passing them to the system shell via SSH. In current infrastructure the URL encoding neutralizes the injection during the standard web upload flow. An authenticated attacker who is able to trigger the OCR functionality for the uploaded file c

Why this priority

Critical severity

A fixed release or distro patch exists.

Risk facts

CVSS score	9.0 (Critical)
Attack vector	Network (remote)
Attack complexity	High
Privileges needed	Low
User interaction	None
EPSS exploit chance	1.3% (top 29%)
CISA exploited list	No
Weakness	CWE-78
Published	2026-07-10
Last modified	2026-10-24

Publisher (CNA): CERT.PL

Last updated 2026-10-24 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Timeline

2026-07-10 10:16 UTCPublished CVE record published
2026-10-24 23:10 UTCUpdated Record last modified

Exact fixes by distribution

Fedora 46 · perl-Alien-Brotli · FIXED · 0.2.2-16.fc46 · FEDORA-2026-a2abe3db79 · source

sudo dnf upgrade --advisory=FEDORA-2026-a2abe3db79

Fedora ELN · mariadb-connector-odbc · FIXED · 3.2.10-1.eln159 · FEDORA-2026-b481dcd597 · source

sudo dnf upgrade --advisory=FEDORA-2026-b481dcd597

Advisories and coverage

Official advisories

CERT Polska: Vulnerabilities in R-SOFT DMS software 2026-07-10

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-41880?

No fixed release is listed yet. Watch the vendor advisory and apply any mitigation shown on this page.

Is CVE-2026-41880 being exploited?

CVE-2026-41880 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-41880 affect?

CVE-2026-41880 affects affected software. Severity is critical (CVSS 9.0). R-SOFT DMS is vulnerable to OS Command Injection in the Optical Character Recognition (OCR) module. Multiple command execution functions accept user-controllable file paths without proper sanitization before passing them to the system shell

How urgent is CVE-2026-41880?

Priority 49/100. Critical severity

References

← Back to latest CVEs