FKIE_CVE-2026-40075
Vulnerability from fkie_nvd - Published: 2026-05-05 22:16 - Updated: 2026-07-24 21:10
Severity
Summary
OpenMRS Core is an open source electronic medical record system platform. In versions 2.7.8 and earlier and versions 2.8.0 through 2.8.5, the `/openmrs/moduleResources/{moduleid}` endpoint is vulnerable to a path traversal attack. The ModuleResourcesServlet constructs a filesystem path from user-controlled input without performing path boundary validation — the getFile() method concatenates the user-supplied path into an absolute filesystem path without calling normalize() or checking that the result stays within the allowed module resources directory. Because this endpoint serves static resources required for rendering the login page, it is not protected by authentication filters, allowing unauthenticated exploitation.
An attacker can traverse directories and read arbitrary files from the server filesystem, including /etc/passwd and application configuration files containing database credentials. Successful exploitation requires the target deployment to run on Apache Tomcat versions prior to 8.5.31, where the ..; path parameter bypass is not mitigated by the container. Deployments on Tomcat 8.5.31 or later and Tomcat 9.0.10 or later are protected at the container level, though the underlying code defect remains. This issue has been fixed in versions after 2.7.8 (within the 2.7.x branch) and in version 2.8.6 and later.
References
| URL | Tags | ||
|---|---|---|---|
| security-advisories@github.com | https://github.com/openmrs/openmrs-core/security/advisories/GHSA-jjgj-cx3q-pw4w | Exploit, Mitigation, Vendor Advisory | |
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | https://github.com/openmrs/openmrs-core/security/advisories/GHSA-jjgj-cx3q-pw4w | Exploit, Mitigation, Vendor Advisory |
{
"affected": [
{
"affectedData": [
{
"product": "openmrs-core",
"vendor": "openmrs",
"versions": [
{
"status": "affected",
"version": "\u003c= 2.7.8"
},
{
"status": "affected",
"version": "\u003e= 2.8.0, \u003c= 2.8.5"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openmrs:openmrs:*:*:*:*:*:*:*:*",
"matchCriteriaId": "36ECEBBA-4717-41A7-9BA3-A3F91085CC7D",
"versionEndIncluding": "2.7.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openmrs:openmrs:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3ECCD1F7-883D-47F2-A8F7-939CD497EC86",
"versionEndIncluding": "2.8.5",
"versionStartIncluding": "2.8.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OpenMRS Core is an open source electronic medical record system platform. In versions 2.7.8 and earlier and versions 2.8.0 through 2.8.5, the `/openmrs/moduleResources/{moduleid}` endpoint is vulnerable to a path traversal attack. The ModuleResourcesServlet constructs a filesystem path from user-controlled input without performing path boundary validation \u2014 the getFile() method concatenates the user-supplied path into an absolute filesystem path without calling normalize() or checking that the result stays within the allowed module resources directory. Because this endpoint serves static resources required for rendering the login page, it is not protected by authentication filters, allowing unauthenticated exploitation.\n\nAn attacker can traverse directories and read arbitrary files from the server filesystem, including /etc/passwd and application configuration files containing database credentials. Successful exploitation requires the target deployment to run on Apache Tomcat versions prior to 8.5.31, where the ..; path parameter bypass is not mitigated by the container. Deployments on Tomcat 8.5.31 or later and Tomcat 9.0.10 or later are protected at the container level, though the underlying code defect remains. This issue has been fixed in versions after 2.7.8 (within the 2.7.x branch) and in version 2.8.6 and later."
},
{
"lang": "es",
"value": "OpenMRS Core es una plataforma de sistema de registro m\u00e9dico electr\u00f3nico de c\u00f3digo abierto. En las versiones 2.7.8 y anteriores, y en las versiones 2.8.0 a 2.8.5, el endpoint \u0027/openmrs/moduleResources/{moduleid}\u0027 es vulnerable a un ataque de salto de ruta. El ModuleResourcesServlet construye una ruta del sistema de archivos a partir de una entrada controlada por el usuario sin realizar una validaci\u00f3n de l\u00edmites de ruta - el m\u00e9todo getFile() concatena la ruta proporcionada por el usuario en una ruta absoluta del sistema de archivos sin llamar a normalize() ni verificar que el resultado permanezca dentro del directorio de recursos del m\u00f3dulo permitido. Debido a que este endpoint sirve recursos est\u00e1ticos necesarios para renderizar la p\u00e1gina de inicio de sesi\u00f3n, no est\u00e1 protegido por filtros de autenticaci\u00f3n, lo que permite la explotaci\u00f3n no autenticada.\n\nUn atacante puede atravesar directorios y leer archivos arbitrarios del sistema de archivos del servidor, incluyendo /etc/p4ssd y archivos de configuraci\u00f3n de aplicaciones que contienen credenciales de base de datos. La explotaci\u00f3n exitosa requiere que la implementaci\u00f3n objetivo se ejecute en versiones de Apache Tomcat anteriores a la 8.5.31, donde el bypass del par\u00e1metro de ruta \u0027..;\u0027 no es mitigado por el contenedor. Las implementaciones en Tomcat 8.5.31 o posterior y Tomcat 9.0.10 o posterior est\u00e1n protegidas a nivel de contenedor, aunque el defecto de c\u00f3digo subyacente permanece. Este problema ha sido solucionado en versiones posteriores a la 2.7.8 (dentro de la rama 2.7.x) y en la versi\u00f3n 2.8.6 y posteriores."
}
],
"id": "CVE-2026-40075",
"lastModified": "2026-07-24T21:10:00.143",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-40075",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-06T14:32:34.742099Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-05-05T22:16:00.520",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Exploit",
"Mitigation",
"Vendor Advisory"
],
"url": "https://github.com/openmrs/openmrs-core/security/advisories/GHSA-jjgj-cx3q-pw4w"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Exploit",
"Mitigation",
"Vendor Advisory"
],
"url": "https://github.com/openmrs/openmrs-core/security/advisories/GHSA-jjgj-cx3q-pw4w"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…