CVE-2026-41879: R-SOFT DMS Information Disclosure Issue

CVE-2026-41879 Overview

CVE-2026-41879 affects R-SOFT DMS, a document management system that stores superadmin credentials using a non-salted nested MD5 hash. An attacker who obtains the password hash can decode the superadmin credentials through brute-force or rainbow table attacks. The vulnerability is compounded by the fact that the superadmin password cannot be changed through the application interface. Administrators must modify the configuration file directly to rotate the credential. The vendor addressed the issue in version v3.17-2000. This weakness is tracked under CWE-328: Use of Weak Hash.

Critical Impact
An attacker who recovers the stored hash can decode superadmin credentials, gaining full administrative control over the affected R-SOFT DMS instance.

Affected Products

R-SOFT DMS versions prior to v3.17-2000
Deployments where the superadmin credential is stored in the configuration file
Installations that have not applied the vendor-supplied fix

Discovery Timeline

2026-07-10 - CVE-2026-41879 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-41879

Vulnerability Analysis

R-SOFT DMS protects the superadmin password by applying MD5 twice in succession, a construction commonly referred to as nested or double MD5. The implementation does not incorporate a per-user salt. Two identical passwords therefore produce identical hashes across all installations. Attackers can pre-compute large candidate hash tables and match them against captured values.

MD5 is cryptographically broken for password storage. Modern GPU hardware evaluates billions of MD5 operations per second, so nesting the algorithm provides no meaningful cost increase. Once an attacker acquires the hash from a backup, a configuration file leak, or database access, credential recovery becomes a matter of time rather than difficulty.

The impact is amplified by the credential rotation constraint. The superadmin password cannot be reset from the application interface. Any operator who fails to edit the configuration file after a suspected exposure leaves the account permanently compromised.

Root Cause

The root cause is the choice of MD5 as the underlying primitive combined with the absence of a salt. Password storage schemes require slow, memory-hard functions such as Argon2, scrypt, or bcrypt with unique salts per credential. Nesting a fast hash does not satisfy this requirement.

Attack Vector

Exploitation requires the attacker to first obtain the stored hash. Access paths include configuration file exposure, database compromise, backup theft, or a chained information disclosure vulnerability. After the hash is obtained, offline cracking recovers the plaintext password. The attacker then authenticates to the R-SOFT DMS interface as superadmin over the network.

No verified proof-of-concept code is publicly available. See the CERT-PL Vulnerability Analysis for additional technical context.

Detection Methods for CVE-2026-41879

Indicators of Compromise

Unexpected superadmin logins from unfamiliar IP addresses or outside standard administrative hours
Modifications to the R-SOFT DMS configuration file that were not initiated by authorized personnel
Access to backup files, database dumps, or configuration files by unusual accounts or processes

Detection Strategies

Enable authentication logging on R-SOFT DMS and forward events to a centralized SIEM for correlation with source IP and geolocation baselines
Monitor file integrity on the R-SOFT DMS configuration file to identify unauthorized changes to the stored credential
Alert on read access to database tables or files containing the superadmin hash by non-service accounts

Monitoring Recommendations

Baseline normal superadmin activity and alert on deviations in login time, source, and command patterns
Track outbound data transfers from R-SOFT DMS servers that could indicate hash exfiltration
Review historical logs for prior access to the configuration file, since compromise may predate detection

How to Mitigate CVE-2026-41879

Immediate Actions Required

Upgrade R-SOFT DMS to version v3.17-2000 or later, which contains the vendor fix
Rotate the superadmin password by editing the configuration file directly after upgrade, assuming the prior hash may already be exposed
Restrict filesystem permissions on the configuration file so only the application service account can read it
Audit all locations where backups, exports, or configuration snapshots have been stored and remove copies containing the old hash

Patch Information

The vendor released a fix in R-SOFT DMS v3.17-2000. Administrators should consult the CERT-PL Vulnerability Analysis for release details and upgrade guidance. Applying the patch alone is insufficient without also rotating the previously stored credential.

Workarounds

Place the R-SOFT DMS management interface behind a VPN or IP allowlist to reduce exposure of the authentication endpoint
Enforce strict access control and monitoring on the configuration file and any backups that could contain the superadmin hash
Require multi-factor authentication at the network or reverse-proxy layer for any session reaching the DMS administrative interface

bash

# Configuration example: restrict access to the R-SOFT DMS configuration file
chown rsoft:rsoft /etc/rsoft-dms/config.conf
chmod 600 /etc/rsoft-dms/config.conf

# Verify permissions
stat -c "%U %G %a" /etc/rsoft-dms/config.conf