CVE-2026-63194: Bahmni-Core: Path traversal may lead to arbitrary file write in the admin CSV import

Published Nov 11, 2026

Updated

OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni (including ERP & ELIS Atom Feed Clients). In version 0.93, there is insufficient validation of input paths during the admin CSV import process, allowing for potential arbitrary file write. This issue has been patched in version 0.93.1.

Affected Software

1 affected component

Bahmni Bahmni-Core=0.93

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade bahmnicore to a version that resolves this vulnerability.
Fixed in 0.93.1

Event History

Nov 11, 2026

CVE Published

via MITRE·02:34 AM

Data Sourced

via MITRE·02:34 AM

DescriptionWeakness

Frequently Asked Questions

Which versions are affected and which version contains the fix?

The issue is present in Bahmni-Core version 0.93 and is patched in version 0.93.1.

What capability could exploitation provide?

Insufficient validation of input paths in the admin CSV import process could allow an arbitrary file write through path traversal.

CVE-2026-63194: Bahmni-Core: Path traversal may lead to arbitrary file write in the admin CSV import

Affected Software

Remediation

Event History

Frequently Asked Questions

Which versions are affected and which version contains the fix?

What capability could exploitation provide?

Company

Resources

Contact

Frequently Asked Questions

Which versions are affected and which version contains the fix?

What capability could exploitation provide?