You are viewing this page in an unauthorized frame window.
This is a potential security issue, you are being redirected to
https://nvd.nist.gov
An official website of the United States government
Official websites use .gov
A .gov website belongs to an official government organization in the United States.
Secure .gov websites use HTTPS
A lock () or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.
OpenMRS Core is an open source electronic medical record system platform. In versions 2.7.8 and earlier and versions 2.8.0 through 2.8.5, the `/openmrs/moduleResources/{moduleid}` endpoint is vulnerable to a path traversal attack. The ModuleResourcesServlet constructs a filesystem path from user-controlled input without performing path boundary validation — the getFile() method concatenates the user-supplied path into an absolute filesystem path without calling normalize() or checking that the result stays within the allowed module resources directory. Because this endpoint serves static resources required for rendering the login page, it is not protected by authentication filters, allowing unauthenticated exploitation.
An attacker can traverse directories and read arbitrary files from the server filesystem, including /etc/passwd and application configuration files containing database credentials. Successful exploitation requires the target deployment to run on Apache Tomcat versions prior to 8.5.31, where the ..; path parameter bypass is not mitigated by the container. Deployments on Tomcat 8.5.31 or later and Tomcat 9.0.10 or later are protected at the container level, though the underlying code defect remains. This issue has been fixed in versions after 2.7.8 (within the 2.7.x branch) and in version 2.8.6 and later.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [email protected].
Title: OpenMRS Core de openmrs, Description: OpenMRS Core es una plataforma de sistema de registro médico electrónico de código abierto. En las versiones 2.7.8 y anteriores, y en las versiones 2.8.0 a 2.8.5, el endpoint '/openmrs/moduleResources/{moduleid}' es vulnerable a un ataque de salto de ruta. El ModuleResourcesServlet construye una ruta del sistema de archivos a partir de una entrada controlada por el usuario sin realizar una validación de límites de ruta - el método getFile() concatena la ruta proporcionada por el usuario en una ruta absoluta del sistema de archivos sin llamar a normalize() ni verificar que el resultado permanezca dentro del directorio de recursos del módulo permitido. Debido a que este endpoint sirve recursos estáticos necesarios para renderizar la página de inicio de sesión, no está protegido por filtros de autenticación, lo que permite la explotación no autenticada.
Un atacante puede atravesar directorios y leer archivos arbitrarios del sistema de archivos del servidor, incluyendo /etc/p4ssd y archivos de configuración de aplicaciones que contienen credenciales de base de datos. La explotación exitosa requiere que la implementación objetivo se ejecute en versiones de Apache Tomcat anteriores a la 8.5.31, donde el bypass del parámetro de ruta '..;' no es mitigado por el contenedor. Las implementaciones en Tomcat 8.5.31 o posterior y Tomcat 9.0.10 o posterior están protegidas a nivel de contenedor, aunque el defecto de código subyacente permanece. Este problema ha sido solucionado en versiones posteriores a la 2.7.8 (dentro de la rama 2.7.x) y en la versión 2.8.6 y posteriores.
OR
*cpe:2.3:a:openmrs:openmrs:*:*:*:*:*:*:*:* versions up to (including) 2.7.8
*cpe:2.3:a:openmrs:openmrs:*:*:*:*:*:*:*:* versions from (including) 2.8.0 up to (including) 2.8.5
New CVE Received from GitHub, Inc.5/05/2026 6:16:00 PM
Action
Type
Old Value
New Value
Added
Description
OpenMRS Core is an open source electronic medical record system platform. In versions 2.7.8 and earlier and versions 2.8.0 through 2.8.5, the `/openmrs/moduleResources/{moduleid}` endpoint is vulnerable to a path traversal attack. The ModuleResourcesServlet constructs a filesystem path from user-controlled input without performing path boundary validation — the getFile() method concatenates the user-supplied path into an absolute filesystem path without calling normalize() or checking that the result stays within the allowed module resources directory. Because this endpoint serves static resources required for rendering the login page, it is not protected by authentication filters, allowing unauthenticated exploitation.
An attacker can traverse directories and read arbitrary files from the server filesystem, including /etc/passwd and application configuration files containing database credentials. Successful exploitation requires the target deployment to run on Apache Tomcat versions prior to 8.5.31, where the ..; path parameter bypass is not mitigated by the container. Deployments on Tomcat 8.5.31 or later and Tomcat 9.0.10 or later are protected at the container level, though the underlying code defect remains. This issue has been fixed in versions after 2.7.8 (within the 2.7.x branch) and in version 2.8.6 and later.
) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.
