CVE-2026-41877 R-SOFT SERWIS CVE debrief

Who should care

Users of R-SOFT DMS, especially those with upload privileges, should be aware of this vulnerability and take steps to protect themselves. This includes updating R-SOFT DMS to version v3.19-2832 or v3.17-2580, restricting file upload privileges to trusted users, and monitoring for suspicious file uploads and user activity.

Technical summary

The vulnerability exists in the file upload functionality of R-SOFT DMS, allowing authenticated attackers to inject arbitrary HTML and JavaScript into file names. This code is then executed when other users view the file list or upload status. The vulnerability has a CVSS score of 5.1 and a severity of MEDIUM. Users with upload privileges should be cautious, as the attack requires authentication. Evidence is limited, and defenders should verify affected scope and vendor guidance, focusing on restricting file upload privileges and monitoring for suspicious activity.

Defensive priority

Medium priority due to the requirement for authentication and the potential impact on user interactions.

Recommended defensive actions

• Update R-SOFT DMS to version v3.19-2832 or v3.17-2580
• Restrict file upload privileges to trusted users
• Monitor for suspicious file uploads and user activity
• Implement additional security controls, such as input validation and output encoding
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-10T10:16:23.847Z and last modified on 2026-07-10T11:16:33.700Z. The NVD entry is currently receiving updates. Evidence is limited, and defenders should verify the affected scope and vendor guidance. The vulnerability exists in R-SOFT DMS file upload functionality, allowing authenticated attackers to inject arbitrary HTML and JavaScript into file names.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.