OpenMRS vulnerabilities
We track 7 vulnerabilities in OpenMRS products across 4 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on September 11, 2026.
Latest OpenMRS vulnerabilities
- 8.7 High severity
org.openmrs.module:legacyui-api: Improper Authorization
OpenMRS is an open source electronic medical record system platform. Prior to versions 1.23.0 and 2.10.0, an authenticated user can trigger administrative DWR services. Specifically, the `startHl7ArchiveMigration` method is accessible, which should be restrict
- 9.1 Critical severity
openmrs-core: Improper Control of Generation of Code
OpenMRS is an open source electronic medical record system platform. From 2.7.0 to before 2.7.9 and 2.8.6, the ConceptReferenceRangeUtility.evaluateCriteria() method in OpenMRS Core evaluates database-stored criteria strings as Apache Velocity templates withou
- 8.8 High severity
openmrs-core: Improper Limitation of a Pathname to a Restricted Directory
OpenMRS Core is an open source electronic medical record system platform. In versions 2.7.8 and earlier and versions 2.8.0 through 2.8.5, the module upload endpoint at POST `/openmrs/ws/rest/v1/module` is vulnerable to a Zip Slip path traversal attack. During
- 7.5 High severity
openmrs-core: Improper Limitation of a Pathname to a Restricted Directory
OpenMRS Core is an open source electronic medical record system platform. In versions 2.7.8 and earlier and versions 2.8.0 through 2.8.5, the `/openmrs/moduleResources/{moduleid}` endpoint is vulnerable to a path traversal attack. The ModuleResourcesServlet co
- 8.0 High severity
openmrs-module-fhir2: Missing Authorization
openmrs-module-fhir2 provides the FHIR REST API and related services for OpenMRS, an open medical records system. In versions of the FHIR2 module prior to 2.5.0, privileges were not always correctly checked, which means that unauthorized users may have been ab
- 8.0 High severity
Openmrs: Cross-Site Request Forgery
A Cross-Site Request Forgery (CSRF) in the component /admin/users/user.form of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted request. In this case, an attacker could elevate a low-privileged account to an administrat
- 7.5 High severity
openmrs-core: Improper Limitation of a Pathname to a Restricted Directory
OpenMRS is a patient-based medical record system focusing on giving providers a free customizable electronic medical record system. Affected versions are subject to arbitrary file exfiltration due to failure to sanitize request when satisfying GET requests for