CVE-2026-41877: R-SOFT DMS Stored XSS Vulnerability

CVE-2026-41877 Overview

CVE-2026-41877 is a stored Cross-Site Scripting (XSS) vulnerability in R-SOFT DMS, a document management system. Authenticated attackers can inject arbitrary HTML and JavaScript into the filename field during file upload operations. The injected payload executes in the browser context of any user who views the file list or upload status page.

The issue is tracked under [CWE-79] and was fixed in versions v3.19-2832 and v3.17-2580. The vulnerability requires an authenticated account with upload permissions and some form of user interaction from the victim.

Critical Impact
Authenticated attackers can execute arbitrary JavaScript in other users' browser sessions, enabling session theft, credential harvesting, and unauthorized actions within the DMS interface.

Affected Products

R-SOFT DMS versions prior to v3.19-2832 (3.19 branch)
R-SOFT DMS versions prior to v3.17-2580 (3.17 branch)
R-SOFT DMS file upload and file listing components

Discovery Timeline

2026-07-10 - CVE-2026-41877 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-41877

Vulnerability Analysis

R-SOFT DMS fails to sanitize user-supplied filenames when files are uploaded through the application. The filename value is stored server-side and later rendered directly into HTML pages that display file lists and upload status information. Because the rendering path does not apply output encoding, HTML and JavaScript embedded in the filename execute in the browsing user's context.

Stored XSS in a document management platform is particularly relevant because multiple users interact with shared file listings. Any user browsing to a page that renders the malicious filename triggers execution. This includes administrators reviewing recent uploads, making privilege escalation through session hijacking a realistic outcome.

The vulnerability requires prior authentication and low privileges, since only upload capability is needed. User interaction is required in the sense that a victim must visit a page rendering the attacker-controlled filename. For further technical background, see the CERT Analysis on the related R-SOFT DMS advisory.

Root Cause

The root cause is missing input validation and improper output encoding of filename metadata. The application treats filenames as trusted display strings rather than untrusted user input. When file listings render, the filename is placed into the HTML document without HTML-entity encoding, allowing tag and script injection.

Attack Vector

An attacker with a valid low-privileged account uploads a file whose name contains an HTML or JavaScript payload, for example a <script> tag or an event handler attribute. The server stores the filename verbatim. When another user, such as an administrator, opens the file list or the upload status view, the payload runs in their browser session and can exfiltrate cookies, invoke authenticated API endpoints, or modify DMS content.

No verified public exploit code is available. The vulnerability mechanism is described in prose only. See the referenced CERT.PL advisory for additional technical details.

Detection Methods for CVE-2026-41877

Indicators of Compromise

Uploaded files whose stored filenames contain HTML tags, angle brackets, or JavaScript event handlers such as onerror=, onload=, or <script>.
Unexpected outbound HTTP requests from user browsers to attacker-controlled hosts immediately after visiting DMS file listing pages.
Anomalous session activity, such as administrative actions performed shortly after an admin viewed the upload status page.

Detection Strategies

Inspect the DMS database or file metadata store for filename values containing <, >, ", ', or javascript: substrings.
Review web server access logs for POST requests to file upload endpoints where the multipart filename parameter includes HTML syntax.
Monitor for Content Security Policy (CSP) violation reports originating from DMS file listing pages.

Monitoring Recommendations

Enable audit logging on the DMS for all file upload actions, capturing the raw filename value and the uploading user account.
Alert on any DMS user session that performs privileged actions within a short window after loading the file list view.
Correlate DMS upload events with endpoint telemetry to identify suspicious file naming patterns across the environment.

How to Mitigate CVE-2026-41877

Immediate Actions Required

Upgrade R-SOFT DMS to v3.19-2832 or v3.17-2580, depending on the deployed branch.
Audit existing stored filenames in the DMS for injected HTML or JavaScript and rename or remove offending entries.
Review recent administrator activity for signs of session compromise resulting from viewing malicious file listings.

Patch Information

R-SOFT resolved the issue in DMS v3.19-2832 and v3.17-2580. Both releases add sanitization and output encoding to filename handling in the file list and upload status views. Administrators running earlier releases on either branch should upgrade to the corresponding fixed version.

Workarounds

Restrict file upload permissions to trusted user roles until the patch is applied.
Deploy a web application firewall rule that rejects multipart uploads whose filename fields contain <, >, or javascript: sequences.
Enforce a strict Content Security Policy that disallows inline script execution on DMS pages to limit payload impact.

bash

# Example WAF rule (ModSecurity) blocking HTML in upload filenames
SecRule REQUEST_HEADERS:Content-Type "@contains multipart/form-data" \
    "chain,phase:2,deny,status:400,id:1041877,msg:'CVE-2026-41877 filename XSS attempt'"
    SecRule REQUEST_BODY "@rx filename=\"[^\"]*[<>][^\"]*\"" "t:none"