Path Traversal Vulnerability in OpenMRS Core Electronic Medical Record System

CVE-2026-40076

What is CVE-2026-40076?

OpenMRS Core is susceptible to a Zip Slip path traversal attack via the module upload endpoint. Authenticated attackers can exploit this vulnerability to write arbitrary files outside the designated module directory, potentially leading to remote code execution. By uploading crafted .omod archives, attackers can manipulate file paths, enabling them to place malicious files within the web application root. This vulnerability arises due to insufficient validation of entry paths during the extraction process. The issue particularly affects deployments that rely on the module.allow_web_admin property for security, as this property is not enforced in the REST API upload path, leaving installations vulnerable. The vulnerability has been addressed in releases after 2.7.8 and in 2.8.6 and later.

References