CVE-2026-41877
Received Received - Intake

Stored XSS in R-SOFT DMS File Upload

Publication date: 2026-07-10

Last updated on: 2026-07-10

Assigner: CERT.PL

Description
R-SOFT DMS is vulnerable to Stored XSS in file upload functionality. Authenticated attacker can inject arbitrary HTML and JS into the name of the file being uploaded, which will be executed when visiting file list or upload status by other users. This issue was fixed in version v3.19-2832 and v3.17-2580.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-10
Last Modified
2026-07-10
Generated
2026-07-10
AI Q&A
2026-07-10
EPSS Evaluated
N/A
NVD
CVE-2026-41877
EUVD
EUVD-2026-42854

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
r-soft dms 3.19-2832
r-soft dms 3.17-2580

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in R-SOFT DMS is a Stored Cross-Site Scripting (XSS) issue found in the file upload functionality.

An authenticated attacker can inject arbitrary HTML and JavaScript code into the name of the file being uploaded.

This malicious code is then executed when other users visit the file list or upload status pages, potentially compromising their security.

Impact Analysis

This vulnerability can allow an attacker to execute malicious scripts in the context of other users' browsers.

Such execution can lead to theft of sensitive information, session hijacking, or performing actions on behalf of the victim user.

Since the attack requires authentication, it may be limited to users with some level of access, but it still poses a significant risk to user data and system integrity.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade R-SOFT DMS to version v3.19-2832 or v3.17-2580 where the issue has been fixed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-41877. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart