CVE-2026-25928 in OpenEMR
要約 (英語)
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, the DICOM zip/export feature uses a user-supplied destination or path component when creating the zip file, without sanitizing path traversal sequences (e.g. `../`). An attacker with DICOM upload/export permission can write files outside the intended directory, potentially under the web root, leading to arbitrary file write and possibly remote code execution if PHP or other executable files can be written. Version 8.0.0.2 fixes the issue.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
責任者
GitHub_M
予約する
2026年02月09日
公開
2026年03月19日
ステータス
確認済み
エントリ
VulDB provides additional information and datapoints for this CVE:
| 識別子 | 脆弱性 | CWE | 悪用可 | 対策 | CVE |
|---|---|---|---|---|---|
| 351749 | OpenEMR DICOM Export ディレクトリトラバーサル | 22 | 未定義 | 公式な修正 | CVE-2026-25928 |