Skip to content
OpenAdvisories
High · 8.7 CVE-2026-63194 EUVD-2026-123073

Bahmni-Core: Path traversal may lead to arbitrary file write in the admin CSV import

Published Nov 11, 2026 · Updated Nov 12, 2026 · Assigned by GitHub_M

Description

OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni (including ERP & ELIS Atom Feed Clients). In version 0.93, there is insufficient validation of input paths during the admin CSV import process, allowing for potential arbitrary file write. This issue has been patched in version 0.93.1.

Affected products

VendorProductAffectedFixed
Bahmni bahmni-core = 0.93 —

References