What is the CVSS score of EUVD-2026-13154?

EUVD-2026-13154 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by EUVD-2026-13154?

Organizations using OpenEMR should be aware of notable risk from CVE-2026-25928, a path traversal vulnerability rated CVSS 6.5. This could allow unauthorized file access.. A patch is available.

How to fix or mitigate EUVD-2026-13154?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review file handling controls.

PHP EUVD-2026-13154

| CVE-2026-25928 MEDIUM

Path Traversal (CWE-22)

2026-03-19 GitHub_M

PHP RCE Path Traversal

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

8.0.0.2

EUVD ID Assigned

Mar 19, 2026 - 20:00 euvd

EUVD-2026-13154

Analysis Generated

Mar 19, 2026 - 20:00 vuln.today

CVE Published

Mar 19, 2026 - 19:27 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, the DICOM zip/export feature uses a user-supplied destination or path component when creating the zip file, without sanitizing path traversal sequences (e.g. ../). An attacker with DICOM upload/export permission can write files outside the intended directory, potentially under the web root, leading to arbitrary file write and possibly remote code execution if PHP or other executable files can be written. Version 8.0.0.2 fixes the issue.

AnalysisAI

Improper path sanitization in OpenEMR's DICOM export feature prior to version 8.0.0.2 allows authenticated users with DICOM permissions to write arbitrary files outside the intended directory through path traversal sequences. An attacker could exploit this to place malicious PHP files within the web root, potentially achieving remote code execution. The vulnerability requires valid credentials but poses significant risk to systems containing sensitive healthcare data.

Technical ContextAI

The vulnerability is rooted in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) within the DICOM export functionality of OpenEMR (cpe:2.3:a:openemr:openemr). The vulnerable code fails to sanitize or validate user-supplied path components before constructing file paths for zip archive creation. When an attacker supplies a malicious destination parameter containing relative path sequences such as ../, the application concatenates this unsanitized input directly into file system operations, allowing traversal beyond the intended export directory. Because OpenEMR is typically deployed as a web application with PHP execution enabled, successful path traversal to web-accessible directories could permit writing executable PHP files that could subsequently be invoked via HTTP requests.

RemediationAI

Immediately upgrade OpenEMR to version 8.0.0.2 or later, which contains the fix for path traversal validation in the DICOM export feature (see https://github.com/openemr/openemr/security/advisories/GHSA-rppw-f689-6hrm). Until patching is feasible, restrict DICOM upload and export functionality to trusted administrators only, and limit network access to the OpenEMR application to internal healthcare networks via firewall rules or VPN. Additionally, configure the web server (Apache/Nginx) to disable PHP execution in export/temporary directories if possible, or implement filesystem-level access controls to prevent execution of uploaded or exported files. Monitor access logs for suspicious patterns involving ../ sequences in DICOM export requests.