HL7 vulnerabilities
We track 2 vulnerabilities in HL7 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on January 24, 2025.
2vulnerabilities
0critical
2high
0exploited
8.3average CVSS score
Latest HL7 vulnerabilities
- 8.6 High severity
fhir-ig-publisher: Improper Restriction of XML External Entity Reference
The HL7 FHIR IG publisher is a tool to take a set of inputs and create a standard FHIR IG. Prior to version 1.7.4, XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag `
- 8.1 High severity
Hl7 Fhir Core: Improper Limitation of a Pathname to a Restricted Directory
HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files into arbitrary directories via directory traversal from a crafted ZIP or TGZ archive (for a prepackaged terminology cache, NPM package, or comparison archive).