Executive brief
OpenMRS Core, an open-source electronic medical record platform, contains a security flaw that allows unauthorized individuals to access sensitive files on the server. By exploiting a specific web address used for loading login page resources, an attacker can bypass security restrictions to read system files, such as database credentials or password files. This could lead to a total compromise of patient data and system security, especially in environments using older web server software.
Technical details
A path traversal vulnerability exists in the `/openmrs/moduleResources/{moduleid}` endpoint of OpenMRS Core. The `ModuleResourcesServlet.getFile()` method fails to normalize or validate user-supplied paths before concatenating them into an absolute filesystem path. Because this endpoint serves static resources for the login page, it is not protected by authentication filters, enabling unauthenticated exploitation. Attackers can use traversal sequences (e.g., `..;`) to escape the intended directory and read sensitive files like `/etc/passwd` or configuration files. While the underlying code is defective in all affected versions, successful exploitation specifically requires the application to be hosted on Apache Tomcat versions prior to 8.5.31 or 9.0.10, which do not mitigate the path parameter bypass at the container level. The issue is fixed in versions after 2.7.8 and in 2.8.6+.
Affected products
- OpenMRS OpenMRS Core <= 2.7.8, 2.8.0 - 2.8.5
Timeline
- 2026-05-04: advisory: GitHub Security Advisory published
- 2026-05-05: disclosed: CVE-2026-40075 published