GHSA-pmw7-2mfv-4592: Bahmni-Core: Path traversal may lead to arbitrary file write in the admin CSV import

Published Nov 11, 2026

Updated

OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni (including ERP & ELIS Atom Feed Clients). In version 0.93, there is insufficient validation of input paths during the admin CSV import process, allowing for potential arbitrary file write. This issue has been patched in version 0.93.1.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OpenMRS module bahmnicore to a version that resolves this vulnerability.
Fixed in 0.93.1

Event History

Nov 11, 2026

CVE Published

via OSV·02:34 AM

Data Sourced

via OSV·02:34 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Deployments using the Bahmni-Core OpenMRS module version 0.93 are affected by the insufficient path validation in the admin CSV import process.

What access does an attacker need to exploit this issue?

The supplied vector indicates network-reachable exploitation with no privileges or user interaction required. The vulnerable functionality is the admin CSV import process.

What is the remediation?

Upgrade Bahmni-Core to version 0.93.1, which patches the issue.

GHSA-pmw7-2mfv-4592: Bahmni-Core: Path traversal may lead to arbitrary file write in the admin CSV import

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to exploit this issue?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to exploit this issue?

What is the remediation?