org.openmrs.web vulnerabilities

Products

• org.openmrs.web/openmrs-web 2

Latest org.openmrs.web CVEs

Newest publication first

1. CVE-2026-40076 OpenMRS Core arbitrary file write and code execution via Zip Slip in module upload

   Published 2026-05-06

   Critical·CVSS 9.4 EPSS 0.85%

   OpenMRS Core is an open source electronic medical record system platform. In versions 2.7.8 and earlier and versions 2.8.0 through 2.8.5, the module upload endpoint at POST /openmrs/ws/rest/v1/module is vulnerable to a Zip Slip path traversal attack. During automatic extraction o...

2. CVE-2026-40075 OpenMRS Core arbitrary file read via path traversal in ModuleResourcesServlet

   Published 2026-05-05

   High·CVSS 8.2 EPSS 0.56%

   OpenMRS Core is an open source electronic medical record system platform. In versions 2.7.8 and earlier and versions 2.8.0 through 2.8.5, the /openmrs/moduleResources/{moduleid} endpoint is vulnerable to a path traversal attack. The ModuleResourcesServlet constructs a filesystem...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.