R-SOFT DMS patches five vulnerabilities
CERT Polska coordinated disclosure of five R-SOFT DMS flaws, including authenticated command injection with root privileges and an unchangeable weak superadmin password hash.
Sourcecert.pl — open the original
What to check
- Applies to
- The 5 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska disclosed five vulnerabilities in R-SOFT DMS, a document management system, following a coordinated vulnerability disclosure process. The most severe issues are two OS command injection flaws: one in the document converter allowing authenticated attackers to run arbitrary commands as the web server user, and another in the OCR module that executes commands over SSH with root privileges, though the vendor notes URL encoding currently mitigates exploitation via the standard web upload flow. Additional issues include a stored XSS in file upload naming, an IDOR allowing any authenticated user to download arbitrary files by ID, and storage of superadmin credentials as a non-salted nested MD5 hash that cannot be changed except by editing the configuration file directly.
All five vulnerabilities require an authenticated session to exploit and there is no indication of active exploitation in the wild; this is a coordinated disclosure and patch advisory rather than a report of ongoing attacks. Fixes are available in versions v3.19-2752/v3.19-2832/v3.19-2862 and v3.17-2000/v3.17-2580 depending on the specific CVE, and organizations running R-SOFT DMS should update to the latest patched builds and rotate the superadmin credential per vendor guidance where feasible.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by Document Management Web Server (Possible Command Injection)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a web application server process (e.g. Java/Tomcat/httpd/nginx worker) spawning a shell or system command interpreter, consistent with OS command injection in a document converter component such as R-SOFT DMS. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Spawning Command Shell
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /java
- /httpd
- /nginx
- /php-fpm
- /tomcat
- /catalina.sh
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
- /curl
- /wget
- /nc
- /python3
- /perl
filter_common:
CommandLine|contains:
- logrotate
- healthcheck
condition: selection_parent and selection_child and not filter_common
falsepositives:
- Legitimate application maintenance scripts invoked by the web server for log rotation
or health checks
- Custom document conversion plugins that legitimately shell out to helper utilities
(uncommon but possible)
level: high
tags:
- attack.t1190
- attack.t1059
id: 493cde00-777d-5fd9-9621-575d9f743491
status: experimental
author: Vorant
Root-Level Command Execution via SSH Following Application-Triggered Session
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects shell command execution under an SSH session running as root shortly after being spawned from a non-interactive context, matching the pattern of the R-SOFT DMS OCR module remote command execution flaw where OCR processing triggers commands over SSH with root privileges. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Root Shell Command Execution via Non-Interactive SSH Session
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith: /sshd
User: root
Image|endswith:
- /sh
- /bash
- /python3
- /perl
CommandLine|contains:
- ;
- '&&'
- '|'
- '`'
- $(
filter_interactive:
CommandLine|contains: -i
condition: selection and not filter_interactive
falsepositives:
- Legitimate automated root SSH jobs (e.g. Ansible, cron-driven remote administration)
that chain multiple shell commands
- Backup or monitoring agents that execute compound commands over SSH as root
level: medium
tags:
- attack.t1059
- attack.t1190
id: b1cb05fa-e56b-51ff-83c3-7f709f1872ff
status: experimental
author: Vorant
Access or Modification of DMS Configuration File Containing Superadmin Credential Hash
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects direct file access or editing of application configuration files that store credential hashes, matching the R-SOFT DMS design flaw where the superadmin password (stored as an unsalted nested MD5 hash) can only be changed by directly editing the config file. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Direct Edit of Application Config File Holding Credential Hash
logsource:
category: file_event
product: linux
detection:
selection:
TargetFilename|contains:
- config
TargetFilename|endswith:
- .conf
- .cfg
- .ini
- .xml
- .properties
selection_process:
Image|endswith:
- /vi
- /vim
- /nano
- /sed
- /awk
- /python3
- /perl
condition: selection and selection_process
falsepositives:
- Legitimate administrative maintenance of application configuration files by authorized
sysadmins during patching or credential rotation
- Configuration management tools (Ansible, Puppet, Chef) applying template updates
to the same files
level: low
tags:
- attack.t1552
- attack.t1552.001
id: ae55b8e9-ccd0-53f2-9a0e-f38099ba5e74
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/07/CVE-2026-41876
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs