EUVD-2026-13154Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 3.1 base score of 6.5 (Medium severity) reflects a network-based attack requiring low privileges and no user interaction, with high integrity impact but no confidentiality or availability impact. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) accurately captures the attack surface: any authenticated user with DICOM permissions can trigger the vulnerability. However, real-world risk escalates significantly if the vulnerability can be leveraged to write executable files (PHP, shell scripts) to the web root—a plausible scenario in many OpenEMR deployments—which would enable remote code execution and elevate this from an integrity issue to a critical availability and confidentiality threat. The availability of a public patch (version 8.0.0.2) and published advisory since early 2026 means defenders have clear guidance; however, the relative ease of exploitation (low attack complexity, no special configuration required) and the likelihood that many healthcare organizations run legacy OpenEMR versions suggests this poses a real and actionable risk to the medical sector. SSVC considerations: exploitation is likely practical (authenticated but predictable), automatable (path traversal is straightforward), and technical impact is severe if RCE is achieved. |
| Exploit ScenarioDerived | An authenticated healthcare staff member with DICOM management permissions (a realistic scenario in many facilities) navigates to the DICOM export interface and supplies a destination path such as |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 19, 2026
Improper path sanitization in OpenEMR's DICOM export feature prior to version 8.0.0.2 allows authenticated users with DICOM permissions to write arbitrary files outside the intended directory through path traversal sequences. An attacker could exploit this to place malicious PHP files within the web root, potentially achieving remote code execution. The vulnerability requires valid credentials but poses significant risk to systems containing sensitive healthcare data.
Earlier versions of this analysis (1)
A path traversal vulnerability exists in OpenEMR's DICOM zip/export feature that allows authenticated users with DICOM upload/export permissions to write arbitrary files outside the intended directory by injecting path traversal sequences (e.g., ../) into the destination parameter. If exploitable to write to the web root, this could enable remote code execution through PHP file placement. The vulnerability affects OpenEMR versions prior to 8.0.0.2, and a security patch is publicly available via the GitHub advisory GHSA-rppw-f689-6hrm.
RemediationAI
Immediately upgrade OpenEMR to version 8.0.0.2 or later, which contains the fix for path traversal validation in the DICOM export feature (see https://github.com/openemr/openemr/security/advisories/GHSA-rppw-f689-6hrm). Until patching is feasible, restrict DICOM upload and export functionality to trusted administrators only, and limit network access to the OpenEMR application to internal healthcare networks via firewall rules or VPN. Additionally, configure the web server (Apache/Nginx) to disable PHP execution in export/temporary directories if possible, or implement filesystem-level access controls to prevent execution of uploaded or exported files. Monitor access logs for suspicious patterns involving ../ sequences in DICOM export requests.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is rooted in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) within the DICOM export functionality of OpenEMR (cpe:2.3:a:openemr:openemr). The vulnerable code fails to sanitize or validate user-supplied path components before constructing file paths for zip archive creation. When an attacker supplies a malicious destination parameter containing relative path sequences such as ../, the application concatenates this unsanitized input directly into file system operations, allowing traversal beyond the intended export directory. Because OpenEMR is typically deployed as a web application with PHP execution enabled, successful path traversal to web-accessible directories could permit writing executable PHP files that could subsequently be invoked via HTTP requests.
Know when Openemr gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, the DICOM zip/export feature uses a user-supplied destination or path component when creating the zip file, without sanitizing path traversal sequences (e.g. ../). An attacker with DICOM upload/export permission can write files outside the intended directory, potentially under the web root, leading to arbitrary file write and possibly remote code execution if PHP or other executable files can be written. Version 8.0.0.2 fixes the issue.
Executive ViewAI
Organizations using OpenEMR should be aware of notable risk from CVE-2026-25928, a path traversal vulnerability rated CVSS 6.5. This could allow unauthorized file access. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict file access via WAF, implement allowlists.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to
Unauthenticated token disclosure in OpenEMR before 8.0.0. CVSS 10.0. PoC and patch available.
Path traversal in OpenEMR 7.0.4 disposeDocument() allows file access. PoC available.
Path traversal in OpenEMR electronic health records before fix allows authenticated users to read arbitrary files on the
SQL injection in OpenEMR electronic health records before fix. Authenticated users can execute arbitrary SQL through the
OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.cl
An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid par
Information disclosure in OpenEMR 5.0.2 to before 8.0.0 exposes sensitive data. PoC and patch available.
Remote code execution in OpenEMR through 8.2.0 lets an authenticated administrator poison the document category tree so
interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shel
interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication
Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote
Exploit-DB