CVE-2026-76614

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-76614

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-76614.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-76614

Aliases

GHSA-gfwc-jg5p-jcp4

Published

2026-08-19T14:55:56.729Z

Modified

2026-08-23T03:53:41.730088737Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

OpenEMR < 8.3.0 Path Traversal Information Disclosure via EDI Archive Restore

Details

OpenEMR before 8.3.0 contains a path traversal vulnerability in the EDI archive restore function. The archrestore_sel POST parameter is passed to the archive restore handler without sanitization for path traversal sequences. The handler checks whether the supplied path exists on the filesystem, and the differing response messages leak whether the target path exists. An authenticated user with EOB Data Entry permissions can probe arbitrary filesystem paths on the server to determine file existence.

Database specific

{
    "cwe_ids": [
        "CWE-22"
    ],
    "cna_assigner": "VulnCheck",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76614.json"
}

References

Affected packages

Git / github.com/openemr/openemr

Affected ranges

Type

GIT

Repo

https://github.com/openemr/openemr

Events

Introduced

Fixed

ebb62eb3036a726314ab3e1c3e9263a41608b17b

Fixed

7973cab3fe3f2fd2374ed71c02605e3c93491c36

Database specific

Show details

{
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "8.3.0"
        }
    ]
}

Affected versions

Other

v2_7_2

v2_7_2-rc1

v2_7_2-rc2

v2_7_3-rc1

v2_8_0

v2_8_1

v2_8_2

v2_8_3

v2_9_0

v3_0_0

v3_0_1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-76614.json"