CVE-2026-76614
Received Received - Intake

Path Traversal in OpenEMR via EDI Archive Restore

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: VulnCheck

Description
OpenEMR before 8.3.0 contains a path traversal vulnerability in the EDI archive restore function. The archrestore_sel POST parameter is passed to the archive restore handler without sanitization for path traversal sequences. The handler checks whether the supplied path exists on the filesystem, and the differing response messages leak whether the target path exists. An authenticated user with EOB Data Entry permissions can probe arbitrary filesystem paths on the server to determine file existence.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-76614
EUVD
EUVD-2026-62515

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openemr openemr to 8.3.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-76614 is a path traversal vulnerability in OpenEMR versions before 8.3.0. It affects the EDI archive restore function in the file /interface/billing/edih_main.php. The archrestore_sel POST parameter is not sanitized for path traversal sequences, allowing an authenticated user with EOB Data Entry permissions to probe the filesystem for arbitrary file existence. The vulnerability occurs because the parameter is passed unsanitized to the archive restore handler, which leaks information through differing response messages when checking file existence.

The issue is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and has a CVSS v4 base score of 5.3 (Moderate). While a coding error prevents actual file deletion, fixing it without addressing the traversal could escalate the impact to arbitrary ZIP file deletion.

Detection Guidance

To detect this vulnerability, monitor for unusual POST requests to /interface/billing/edih_main.php with the archrestore_sel parameter. Check for differing HTTP response messages indicating file existence probes. Review logs for authenticated users with EOB Data Entry permissions making such requests.

Impact Analysis

An attacker with low privileges and network access could exploit this to probe your server's filesystem and determine which files exist. This could lead to information disclosure, such as identifying sensitive files or configurations. While direct data theft or modification is limited, the ability to enumerate files may aid in further attacks or reconnaissance.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive files, potentially leading to data breaches. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information. The information disclosure risk may violate these regulations if exploited, resulting in legal and financial penalties.

Mitigation Strategies

Immediately upgrade OpenEMR to version 8.3.0 or later to patch the vulnerability. Ensure proper input sanitization for the archrestore_sel parameter. Implement strict ACL checks for users with EOB Data Entry permissions to limit filesystem probing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76614. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart