EUVD-2026-62515
GHSA-7994-gr8j-h7xp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible with low-privilege authenticated access (specific EOB Data Entry role required); impact is bounded to low confidentiality via existence oracle with no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
OpenEMR before 8.3.0 contains a path traversal vulnerability in the EDI archive restore function. The archrestore_sel POST parameter is passed to the archive restore handler without sanitization for path traversal sequences. The handler checks whether the supplied path exists on the filesystem, and the differing response messages leak whether the target path exists. An authenticated user with EOB Data Entry permissions can probe arbitrary filesystem paths on the server to determine file existence.
AnalysisAI
Path traversal in OpenEMR's EDI archive restore function before version 8.3.0 enables authenticated users with EOB Data Entry permissions to enumerate arbitrary filesystem paths on the server via a differential response oracle. The unsanitized archrestore_sel POST parameter is passed directly to the archive restore handler, which checks the resolved path against the filesystem and returns distinct messages depending on whether the path exists - leaking file existence without disclosing file contents. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an active authenticated OpenEMR session assigned the EOB Data Entry permission, a role specifically associated with billing and claims processing (Explanation of Benefits workflows). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.3 (Medium) is well-calibrated for this vulnerability: network reachability and low attack complexity are offset by the requirement for an authenticated session with a specific EOB Data Entry role, and the impact is strictly bounded to low confidentiality - file existence disclosure, not content exposure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated OpenEMR user holding the EOB Data Entry role submits crafted POST requests to the EDI archive restore endpoint with the `archrestore_sel` parameter set to path traversal sequences such as `../../etc/passwd` or `../../var/backups/openemr.sql`. The handler resolves each path and returns a distinct HTTP response depending on whether the file exists, functioning as a boolean oracle. … |
| Remediation | Upgrade to OpenEMR 8.3.0 or later, which resolves this vulnerability as confirmed by the vendor advisory at https://github.com/openemr/openemr/security/advisories/GHSA-gfwc-jg5p-jcp4 and the patch commit at https://github.com/openemr/openemr/commit/7973cab3fe3f2fd2374ed71c02605e3c93491c36. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to
Unauthenticated token disclosure in OpenEMR before 8.0.0. CVSS 10.0. PoC and patch available.
Path traversal in OpenEMR 7.0.4 disposeDocument() allows file access. PoC available.
Path traversal in OpenEMR electronic health records before fix allows authenticated users to read arbitrary files on the
SQL injection in OpenEMR electronic health records before fix. Authenticated users can execute arbitrary SQL through the
OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.cl
An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid par
Information disclosure in OpenEMR 5.0.2 to before 8.0.0 exposes sensitive data. PoC and patch available.
interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shel
Remote code execution in OpenEMR through 8.2.0 lets an authenticated administrator poison the document category tree so
interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication
Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today