R-SOFT DMS patches five vulnerabilities
CERT Polska coordinated disclosure of five R-SOFT DMS flaws, including authenticated command injection with root privileges and an unchangeable weak superadmin password hash.
CERT Polska disclosed five vulnerabilities in R-SOFT DMS, a document management system, following a coordinated vulnerability disclosure process. The most severe issues are two OS command injection flaws: one in the document converter allowing authenticated attackers to run arbitrary commands as the web server user, and another in the OCR module that executes commands over SSH with root privileges, though the vendor notes URL encoding currently mitigates exploitation via the standard web upload flow. Additional issues include a stored XSS in file upload naming, an IDOR allowing any authenticated user to download arbitrary files by ID, and storage of superadmin credentials as a non-salted nested MD5 hash that cannot be changed except by editing the configuration file directly.
All five vulnerabilities require an authenticated session to exploit and there is no indication of active exploitation in the wild; this is a coordinated disclosure and patch advisory rather than a report of ongoing attacks. Fixes are available in versions v3.19-2752/v3.19-2832/v3.19-2862 and v3.17-2000/v3.17-2580 depending on the specific CVE, and organizations running R-SOFT DMS should update to the latest patched builds and rotate the superadmin credential per vendor guidance where feasible.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by Document Management Web Server (Possible Command Injection)
Detects a web application server process (e.g. Java/Tomcat/httpd/nginx worker) spawning a shell or system command interpreter, consistent with OS command injection in a document converter component such as R-SOFT DMS. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Spawning Command Shell
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /java
- /httpd
- /nginx
- /php-fpm
- /tomcat
- /catalina.sh
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
- /curl
- /wget
- /nc
- /python3
- /perl
filter_common:
CommandLine|contains:
- logrotate
- healthcheck
condition: selection_parent and selection_child and not filter_common
falsepositives:
- Legitimate application maintenance scripts invoked by the web server for log rotation
or health checks
- Custom document conversion plugins that legitimately shell out to helper utilities
(uncommon but possible)
level: high
tags:
- attack.t1190
- attack.t1059
id: 493cde00-777d-5fd9-9621-575d9f743491
status: experimental
author: Vorant
Root-Level Command Execution via SSH Following Application-Triggered Session
Detects shell command execution under an SSH session running as root shortly after being spawned from a non-interactive context, matching the pattern of the R-SOFT DMS OCR module remote command execution flaw where OCR processing triggers commands over SSH with root privileges. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Root Shell Command Execution via Non-Interactive SSH Session
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith: /sshd
User: root
Image|endswith:
- /sh
- /bash
- /python3
- /perl
CommandLine|contains:
- ;
- '&&'
- '|'
- '`'
- $(
filter_interactive:
CommandLine|contains: -i
condition: selection and not filter_interactive
falsepositives:
- Legitimate automated root SSH jobs (e.g. Ansible, cron-driven remote administration)
that chain multiple shell commands
- Backup or monitoring agents that execute compound commands over SSH as root
level: medium
tags:
- attack.t1059
- attack.t1190
id: b1cb05fa-e56b-51ff-83c3-7f709f1872ff
status: experimental
author: Vorant
Access or Modification of DMS Configuration File Containing Superadmin Credential Hash
Detects direct file access or editing of application configuration files that store credential hashes, matching the R-SOFT DMS design flaw where the superadmin password (stored as an unsalted nested MD5 hash) can only be changed by directly editing the config file. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Direct Edit of Application Config File Holding Credential Hash
logsource:
category: file_event
product: linux
detection:
selection:
TargetFilename|contains:
- config
TargetFilename|endswith:
- .conf
- .cfg
- .ini
- .xml
- .properties
selection_process:
Image|endswith:
- /vi
- /vim
- /nano
- /sed
- /awk
- /python3
- /perl
condition: selection and selection_process
falsepositives:
- Legitimate administrative maintenance of application configuration files by authorized
sysadmins during patching or credential rotation
- Configuration management tools (Ansible, Puppet, Chef) applying template updates
to the same files
level: low
tags:
- attack.t1552
- attack.t1552.001
id: ae55b8e9-ccd0-53f2-9a0e-f38099ba5e74
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/07/CVE-2026-41876
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free