CVE-2026-40076 OpenMRS Core arbitrary file write and code execution via Zip Slip in module upload
Authenticated attackers can exploit a Zip Slip vulnerability in OpenMRS Core module uploads to write arbitrary files and execute remote code.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-40076?
CVE-2026-40076 is a critical path traversal vulnerability in openmrs-core, published on 6 May 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
OpenMRS Core is an open source electronic medical record system platform. In versions 2.7.8 and earlier and versions 2.8.0 through 2.8.5, the module upload endpoint at POST `/openmrs/ws/rest/v1/module` is vulnerable to a Zip Slip path traversal attack. During automatic extraction of uploaded .omod archives in `WebModuleUtil.startModule()`, ZIP entries under web/module/ are checked only to see whether the full entry path starts with `..,` and the remaining path is then concatenated into the destination path without normalization or a boundary check. A crafted archive can therefore include entries such as `web/module/../../../../malicious.jsp` and cause files to be written outside the intended module directory.
An authenticated attacker with module upload access can write arbitrary files to locations such as the web application root and achieve remote code execution by uploading a JSP file and then requesting it. The issue is compounded by the fact that the module.allow_web_admin runtime property is enforced in the legacy UI controller but not in the REST API upload path, so deployments relying on that property to block web-based module administration remain exposed through the REST endpoint. This issue has been fixed in versions after 2.7.8 in the 2.7.x line and in version 2.8.6 and later.
Weakness: CWE-22
Which versions are affected by CVE-2026-40076?
4 open source packages ship an affected version, including org.openmrs.web:openmrs-web. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.openmrs.web:openmrs-web Maven | All versions to 2.7.8 | None |
org.openmrs.web:openmrs-web Maven | All versions to 2.7.8 | None |
org.openmrs.web:openmrs-web Maven | From 2.8.0 to 2.8.5 | None |
org.openmrs.web:openmrs-web Maven | From 2.8.0 to 2.8.5 | None |
Products include Openmrs Openmrs.
How do I fix CVE-2026-40076?
No fix has been published for CVE-2026-40076 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-40076 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40076 exists.
Other vulnerabilities in openmrs-core
Sources
Also known as GHSA-78fc-9688-w8xw.