Executive brief
OpenMRS Core, an open-source platform for managing electronic medical records, is vulnerable to a security flaw in its module upload system. An authorized user can upload a specially crafted module file that bypasses security restrictions to write malicious files onto the server's file system. This can lead to a complete takeover of the medical record system, potentially exposing sensitive patient data or disrupting healthcare operations.
Technical details
A Zip Slip path traversal vulnerability exists in the OpenMRS Core REST API at the POST `/openmrs/ws/rest/v1/module` endpoint. The root cause is insufficient path validation in `WebModuleUtil.startModule()`, which only checks if ZIP entries start with '..' but fails to normalize the path before concatenation. An authenticated attacker with module upload privileges can provide a crafted .omod archive containing entries like `web/module/../../../../malicious.jsp` to write arbitrary files into the web application root. This allows for Remote Code Execution (RCE) via JSP shell execution. Additionally, the `module.allow_web_admin` security property is bypassed as it is only enforced in the legacy UI and not the REST API. The issue is patched in versions 2.7.9+ and 2.8.6+.
Affected products
- OpenMRS OpenMRS Core <= 2.7.8, 2.8.0 - 2.8.5
Timeline
- 2026-05-04: advisory: GitHub Security Advisory published
- 2026-05-06: disclosed: CVE-2026-40076 published