Executive brief
OpenMRS, an open-source medical record system used by healthcare facilities, contains a vulnerability that allows users with concept management permissions to execute malicious code on the server. By saving a specially crafted script in a medical concept's reference range field, an attacker can gain full control over the application server and access sensitive patient health information. This could lead to a total system compromise, data theft, or disruption of clinical operations.
Technical details
A Server-Side Template Injection (SSTI) vulnerability exists in the ConceptReferenceRangeUtility.evaluateCriteria() method of OpenMRS Core. The application evaluates database-stored criteria strings as Apache Velocity templates without a sandbox or SecureUberspector, allowing unrestricted Java reflection via template expressions. An attacker with 'Manage Concepts' privileges can inject malicious Velocity templates into a concept's reference range criteria field. This payload is executed automatically during observation validation, providing access to the $patient and $obs objects, as well as the full OpenMRS service layer via the $fn instance. The vulnerability is patched in versions 2.7.9 and 2.8.6.
Affected products
- OpenMRS OpenMRS Core 2.7.0 to 2.7.8, 2.8.0 to 2.8.5
Timeline
- 2026-05-04: advisory: GitHub security advisory published
- 2026-05-15: disclosed: CVE published to NVD