Stored XSS in R-SOFT DMS
Priority LOW 23CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
R-SOFT DMS is vulnerable to Stored XSS in file upload functionality. Authenticated attacker can inject arbitrary HTML and JS into the name of the file being uploaded, which will be executed when visiting file list or upload status by other users. This issue was fixed in version v3.19-2832 and v3.17-2580.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0039 33rd percentileScored 2026-11-07
Fix Fixed DMS (R-SOFT SERWIS): v3.19-2832, v3.17-2580
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| R-SOFT SERWIS | DMS | before v3.19-2832; before v3.17-2580 | v3.19-2832, v3.17-2580 | Patch available | CNA |
- DMS VendorR-SOFT SERWIS Affected before v3.19-2832; before v3.17-2580 Fixed in v3.19-2832, v3.17-2580 Patch available CNA
Remediation
- Fix · CNA DMS (R-SOFT SERWIS) Fixed in v3.19-2832, v3.17-2580
Timeline
- 2026-10-02 Threatist record created from CVE-2026-41877
- 2026-10-03 Alias added: GHSA-c9ph-5j66-3j9f
References
More R-SOFT SERWIS vulnerabilities
- TI-2026-30285 OS Command Injection in R-SOFT DMS CVSS 4.0CRITICAL 9.0
- TI-2026-30281 OS Command Injection in R-SOFT DMS CVSS 4.0HIGH 8.7
- TI-2026-30284 Weak password hashing in R-SOFT DMS CVSS 4.0HIGH 8.2
- TI-2026-30283 Insecure Direct Object Reference in R-SOFT DMS CVSS 4.0HIGH 7.1
Sources
- CVE-2026-41877 · CVE Program
- CVE-2026-41877 · NVD
- FIRST EPSS
- GHSA-c9ph-5j66-3j9f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences