CVE-2026-25928

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25928", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-09T16:22:17.785Z", "datePublished": "2026-03-19T19:27:17.018Z", "dateUpdated": "2026-03-21T03:35:07.323Z"}, "containers": {"cna": {"title": "OpenEMR Vulnerable to Path Traversal When Zipping DICOM Folders", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/openemr/openemr/security/advisories/GHSA-rppw-f689-6hrm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/openemr/openemr/security/advisories/GHSA-rppw-f689-6hrm"}, {"name": "https://github.com/openemr/openemr/commit/ddcf04ea769a33cdc1932355224575478df70585", "tags": ["x_refsource_MISC"], "url": "https://github.com/openemr/openemr/commit/ddcf04ea769a33cdc1932355224575478df70585"}], "affected": [{"vendor": "openemr", "product": "openemr", "versions": [{"version": "< 8.0.0.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-19T19:27:17.018Z"}, "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, the DICOM zip/export feature uses a user-supplied destination or path component when creating the zip file, without sanitizing path traversal sequences (e.g. `../`). An attacker with DICOM upload/export permission can write files outside the intended directory, potentially under the web root, leading to arbitrary file write and possibly remote code execution if PHP or other executable files can be written. Version 8.0.0.2 fixes the issue."}], "source": {"advisory": "GHSA-rppw-f689-6hrm", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-21T03:34:33.499364Z", "id": "CVE-2026-25928", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-21T03:35:07.323Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25928", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-21T03:34:33.499364Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-21T03:35:00.771Z"}}], "cna": {"title": "OpenEMR Vulnerable to Path Traversal When Zipping DICOM Folders", "source": {"advisory": "GHSA-rppw-f689-6hrm", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "openemr", "product": "openemr", "versions": [{"status": "affected", "version": "< 8.0.0.2"}]}], "references": [{"url": "https://github.com/openemr/openemr/security/advisories/GHSA-rppw-f689-6hrm", "name": "https://github.com/openemr/openemr/security/advisories/GHSA-rppw-f689-6hrm", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/openemr/openemr/commit/ddcf04ea769a33cdc1932355224575478df70585", "name": "https://github.com/openemr/openemr/commit/ddcf04ea769a33cdc1932355224575478df70585", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, the DICOM zip/export feature uses a user-supplied destination or path component when creating the zip file, without sanitizing path traversal sequences (e.g. `../`). An attacker with DICOM upload/export permission can write files outside the intended directory, potentially under the web root, leading to arbitrary file write and possibly remote code execution if PHP or other executable files can be written. Version 8.0.0.2 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-19T19:27:17.018Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25928", "state": "PUBLISHED", "dateUpdated": "2026-03-21T03:35:07.323Z", "dateReserved": "2026-02-09T16:22:17.785Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-19T19:27:17.018Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "openemr", "vendor": "openemr", "versions": [{"status": "affected", "version": "< 8.0.0.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*", "matchCriteriaId": "C78F19AD-BD18-4F61-8B1C-DD099DBC6D34", "versionEndExcluding": "8.0.0.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, the DICOM zip/export feature uses a user-supplied destination or path component when creating the zip file, without sanitizing path traversal sequences (e.g. `../`). An attacker with DICOM upload/export permission can write files outside the intended directory, potentially under the web root, leading to arbitrary file write and possibly remote code execution if PHP or other executable files can be written. Version 8.0.0.2 fixes the issue."}, {"lang": "es", "value": "OpenEMR es una aplicaci\u00f3n de c\u00f3digo abierto y gratuita para registros de salud electr\u00f3nicos y gesti\u00f3n de consultorios m\u00e9dicos. Antes de la 8.0.0.2, la funci\u00f3n de compresi\u00f3n/exportaci\u00f3n DICOM utiliza un destino o componente de ruta proporcionado por el usuario al crear el archivo zip, sin sanear las secuencias de salto de ruta (por ejemplo, '../'). Un atacante con permiso de carga/exportaci\u00f3n DICOM puede escribir archivos fuera del directorio previsto, potencialmente bajo la ra\u00edz web, lo que lleva a una escritura de archivos arbitraria y posiblemente a una ejecuci\u00f3n remota de c\u00f3digo si se pueden escribir archivos PHP u otros archivos ejecutables. La versi\u00f3n 8.0.0.2 corrige el problema."}], "id": "CVE-2026-25928", "lastModified": "2026-06-17T10:25:26.587", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25928", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-21T03:34:33.499364Z", "version": "2.0.3"}}]}, "published": "2026-03-19T20:16:13.720", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/openemr/openemr/commit/ddcf04ea769a33cdc1932355224575478df70585"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/openemr/openemr/security/advisories/GHSA-rppw-f689-6hrm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,8.0.0.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "openemr", "source": "cna", "vendor": "openemr"}, "product": "openemr", "vendor": "openemr"}], "analysis": {"en": {"generated_at": "2026-03-20T18:23:56.866446+00:00", "value": {"mitigation_remediation": ["Upgrade OpenEMR to version 8.0.0.2 or later.", "If an upgrade is not immediately possible, remove DICOM upload/export permissions from users who do not need them.", "Restrict write access to the web root directory and monitor for unexpected file creations.", "Consider moving the OpenEMR installation outside of the served web directory to limit potential impact of file writes."], "summary": {"action": "Immediate Patch", "impact": "Arbitrary file write potentially enabling remote code execution"}, "threat_synthesis": {"affected_systems": "The flaw exists in the openemr openemr electronic health records product before version 8.0.0.2. Users running any release of OpenEMR older than 8.0.0.2 that includes the DICOM zip/export feature are vulnerable. The affected functionality is the DICOM folder export that creates zip archives.", "description_and_impact": "OpenEMR encrypts DICOM folders into a zip file by directly using a user\u2011supplied path component without sanitization. The directory traversal sequences (e.g., \"../\") allow an attacker to place files outside the intended export directory. An attacker who can upload or export DICOM data can therefore write files to arbitrary locations, including the web root. If the written files contain executable code such as PHP scripts, this can lead to remote code execution. The weakness is a classic path\u2011traversal issue, classified as CWE\u201122.", "risk_and_exploitability": "The CVSS score is 6.5, indicating moderate severity, and the EPSS score is below 1%, suggesting a low probability of public exploitation so far. The vulnerability is not listed in the CISA KEV catalog, but it can be leveraged by users with DICOM upload/export permissions, which may be a common role in clinical settings. An attacker would craft a DICOM file whose filename contains traversal sequences, upload it, then trigger an export to force the application to write the file outside the intended directory. No known public exploits are disclosed yet, but the attack path is straightforward if the necessary permissions are available. The official fix is to upgrade to OpenEMR 8.0.0.2 or later, where the path component is properly sanitized."}}}}, "created": "2026-03-20T08:56:29.121691+00:00", "updated": "2026-03-25T11:55:13.699578+00:00", "vendors": ["openemr", "openemr$PRODUCT$openemr"]}