Description

OpenEMR before 8.3.0 contains a path traversal vulnerability in the EDI archive restore function. The archrestore_sel POST parameter is passed to the archive restore handler without sanitization for path traversal sequences. The handler checks whether the supplied path exists on the filesystem, and the differing response messages leak whether the target path exists. An authenticated user with EOB Data Entry permissions can probe arbitrary filesystem paths on the server to determine file existence.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-19T15:18:11.353Z",
  "pubdate": "2026-08-19T15:18:11.353Z",
  "executiveSummary": "OpenEMR before 8.3.0 suffers from a path traversal vulnerability residing within its Electronic Data Interchange (EDI) archive restore functionality.\nThe vulnerability allows an authenticated attacker with specific permissions to probe arbitrary filesystem paths across the underlying server infrastructure.\nBy manipulating the archrestore_sel POST parameter, an attacker can leverage differing application response messages to accurately determine the existence of arbitrary files and directories.\nThis information disclosure vector enables internal reconnaissance, potentially exposing sensitive system configurations or file structures to unauthorized users.\nExploitation requires authentication and specific functional privileges, namely EOB Data Entry permissions, limiting the attack surface to malicious insiders or compromised privileged accounts.",
  "technicalDetails": "The vulnerability stems from improper input validation and insufficient sanitization of the archrestore_sel POST parameter within the archive restore handler of OpenEMR.\nThe affected component fails to filter path traversal sequences, such as dot-dot-slash patterns, allowing supplied input to directly influence filesystem operations.\nDuring execution, the handler verifies whether the user-supplied path exists on the host filesystem.\nThe application subsequently returns differing response messages based on whether the target path is successfully resolved on the disk.\nAn authenticated attacker possessing EOB Data Entry permissions can systematically abuse this behavior to execute a file existence oracle attack.\nThe step-by-step attack flow involves crafting malicious POST requests containing traversal sequences within the archrestore_sel parameter to target arbitrary paths.\nThe server processes the unsanitized path and evaluates its existence on the underlying filesystem.\nThe application leaks the status of the queried path through distinct response discrepancies.\nBy iterating through various directory and file targets, the attacker maps the server filesystem and gathers reconnaissance data.\nThe affected versions include all OpenEMR deployments prior to version 8.3.0.\nThe attack vector requires network access to the application interface, valid user credentials, and specific application privileges."
}