OpenClinica vulnerabilities
We track 4 vulnerabilities in OpenClinica products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on November 10, 2025.
Latest OpenClinica vulnerabilities
- 8.8 High severity
Community Edition: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability was found in OpenClinica Community Edition up to 3.12.2/3.13. This affects an unknown part of the file /ImportCRFData?action=confirm of the component CRF Data Import. Performing manipulation of the argument xml_file results in path traversal. T
- 8.8 High severity
Community Edition: XML Injection
A vulnerability has been found in OpenClinica Community Edition up to 3.12.2/3.13. Affected by this issue is some unknown functionality of the file /ImportCRFData?action=confirm of the component CRF Data Import. Such manipulation of the argument xml_file leads
- 9.8 Critical severity
OpenClinica: Improper Neutralization of Special Elements used in an SQL Command
OpenClinica is an open source software for Electronic Data Capture (EDC) and Clinical Data Management (CDM). Versions prior to 3.16.1 are vulnerable to SQL injection due to the use of string concatenation to create SQL queries instead of prepared statements. N
- 9.8 Critical severity
OpenClinica: Improper Limitation of a Pathname to a Restricted Directory
OpenClinica is an open source software for Electronic Data Capture (EDC) and Clinical Data Management (CDM). OpenClinica prior to version 3.16 is vulnerable to path traversal in multiple endpoints, leading to arbitrary file read/write, and potential remote cod