CVE-2026-76614: OpenEMR < 8.3.0 Path Traversal Information Disclosure via EDI Archive Restore
OpenEMR before 8.3.0 contains a path traversal vulnerability in the EDI archive restore function. The archrestoresel POST parameter is passed to the archive restore handler without sanitization for path traversal sequences. The handler checks whether the supplied path exists on the filesystem, and the differing response messages leak whether the target path exists. An authenticated user with EOB Data Entry permissions can probe arbitrary filesystem paths on the server to determine file existence.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to OpenEMR and have EOB Data Entry permissions. Unauthenticated users are not described as able to exploit it.
What information can an attacker obtain?
The attacker can probe arbitrary filesystem paths and use differing application responses to determine whether a target path exists. The described impact is file-existence disclosure, not reading file contents or modifying files.
Are systems on the default configuration affected?
The available information does not state whether EOB Data Entry permissions are assigned by default. Exposure depends on having an authenticated account with that permission.
How can I determine whether an instance is vulnerable?
OpenEMR versions before 8.3.0 are affected. A vulnerable instance allows the EDI archive restore function's archrestore_sel POST parameter to reach the restore handler without path-traversal sanitization.
What should be done if upgrading cannot happen immediately?
Restrict EOB Data Entry permissions to only trusted users, since that permission is required for exploitation. Monitor use of the EDI archive restore function and investigate attempts to submit path-traversal sequences through the archrestore_sel parameter.