CVE-2026-76614
OpenEMR < 8.3.0 Path Traversal Information Disclosure via EDI Archive Restore
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
OpenEMR before 8.3.0 contains a path traversal vulnerability in the EDI archive restore function. The archrestore_sel POST parameter is passed to the archive restore handler without sanitization for path traversal sequences. The handler checks whether the supplied path exists on the filesystem, and the differing response messages leak whether the target path exists. An authenticated user with EOB Data Entry permissions can probe arbitrary filesystem paths on the server to determine file existence.
| CWE | CWE-22 |
| Vendor | openemr |
| Product | openemr |
| Published | Aug 19, 2026 |
Stay Ahead of the Next One
Get instant alerts for openemr openemr
Be the first to know when new medium vulnerabilities affecting openemr openemr are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
openemr / openemr
0 < 8.3.0
References
github.com: https://github.com/openemr/openemr/security/advisories/GHSA-gfwc-jg5p-jcp4 github.com: https://github.com/openemr/openemr/releases/tag/v8_3_0 github.com: https://github.com/openemr/openemr/commit/7973cab3fe3f2fd2374ed71c02605e3c93491c36 vulncheck.com: https://www.vulncheck.com/advisories/openemr-path-traversal-information-disclosure-via-edi-archive-restore
Credits
Alex Williams from Pellera Technologies VulnCheck