CVE-2026-41880 Overview
CVE-2026-41880 is an OS Command Injection vulnerability [CWE-78] in the Optical Character Recognition (OCR) module of R-SOFT DMS. Multiple command execution functions accept user-controllable file paths without proper sanitization before passing them to the system shell over SSH. An authenticated attacker who can trigger the OCR functionality against an uploaded file can execute operating system commands in the context of the root user. In the default deployment, URL encoding during the standard web upload flow neutralizes the injection, which raises attack complexity. The issue is fixed in versions v3.19-2862 and v3.17-2580.
Critical Impact
Successful exploitation yields root-level command execution on the underlying host, enabling full compromise of the document management system and its stored data.
Affected Products
- R-SOFT DMS versions prior to v3.19-2862
- R-SOFT DMS versions prior to v3.17-2580
- OCR module component of R-SOFT DMS
Discovery Timeline
- 2026-07-10 - CVE-2026-41880 published to NVD
- 2026-07-10 - Last updated in NVD database
Technical Details for CVE-2026-41880
Vulnerability Analysis
The vulnerability resides in the OCR module of R-SOFT DMS. Several internal functions responsible for invoking OCR processing accept file path parameters that originate from user-controllable input. These paths are concatenated into shell command strings and executed on a remote worker over SSH without sanitization or argument quoting. Because the SSH invocation runs as root, injected commands execute with the highest privilege level on the target host. The vulnerability is classified as OS Command Injection under [CWE-78].
Root Cause
The root cause is the absence of input validation and shell metacharacter escaping on file path parameters passed to command execution functions. The affected functions build shell command lines through string concatenation and hand them to the system shell via SSH. Any shell metacharacters embedded in a controlled file path, such as backticks, semicolons, or $() substitution, are interpreted by the remote shell rather than treated as literal path characters.
Attack Vector
An authenticated attacker must place a file whose name or path contains shell metacharacters into the system and then trigger the OCR functionality against that file. In the standard web upload flow, URL encoding neutralizes the injection payload, so exploitation requires an ingest path that preserves the raw metacharacters. Once OCR processing is triggered, the injected commands execute as root on the OCR worker host. See the CERT PL CVE-2026-41876 Analysis for additional context on the vulnerability class in R-SOFT DMS.
Detection Methods for CVE-2026-41880
Indicators of Compromise
- File names or upload records containing shell metacharacters such as `, ;, |, $(, or && associated with OCR processing jobs.
- Unexpected child processes spawned by the OCR worker or SSH session running as root.
- Outbound network connections initiated from the OCR host to unfamiliar destinations shortly after OCR job execution.
- New or modified files in system directories following an OCR job on an unusually named document.
Detection Strategies
- Audit R-SOFT DMS application logs for OCR jobs whose input path parameters contain shell metacharacters.
- Monitor process ancestry on the OCR host for shells or interpreters (bash, sh, python, curl, wget) spawned from the OCR processing binary.
- Correlate SSH command invocations on the OCR worker with the associated uploader account to identify anomalous command patterns.
Monitoring Recommendations
- Enable verbose command auditing (auditdexecve rules) on hosts running the OCR module and forward events to a central SIEM.
- Alert on any process running as root that is spawned as a descendant of the OCR service account or SSH daemon on the worker host.
- Track file upload metadata, including original file names, to detect metacharacter-laden inputs before OCR is triggered.
How to Mitigate CVE-2026-41880
Immediate Actions Required
- Upgrade R-SOFT DMS to version v3.19-2862 or v3.17-2580, which contain the vendor fix.
- Restrict access to the OCR functionality to trusted authenticated users only, and review recent OCR job history for suspicious file names.
- Rotate credentials and SSH keys used by the OCR worker if compromise is suspected.
Patch Information
The vendor addressed CVE-2026-41880 in R-SOFT DMS v3.19-2862 and v3.17-2580. Administrators running earlier releases on either branch should upgrade to the corresponding fixed version. Refer to the CERT PL CVE-2026-41876 Analysis for related advisory information.
Workarounds
- Disable the OCR module until the patched version is deployed if OCR is not business-critical.
- Enforce strict file name validation at the ingest layer to reject uploads containing shell metacharacters.
- Run the OCR worker under a least-privilege account rather than root to limit blast radius if exploitation occurs.
- Restrict network reachability of the OCR SSH endpoint to the DMS application server only.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
