CVE-2025-29789: OpenEMR Path Traversal Vulnerability

CVE-2025-29789 Overview

CVE-2025-29789 is a directory traversal vulnerability in OpenEMR, a widely deployed open source electronic health records and medical practice management application. Versions prior to 7.3.0 fail to properly sanitize file path input in the Load Code feature, allowing authenticated users with high privileges to traverse outside the intended directory. The flaw is tracked under [CWE-22] (Path Traversal) and [CWE-23] (Relative Path Traversal). OpenEMR maintainers released version 7.3.0 to address the issue.

Critical Impact
An authenticated attacker with high privileges and user interaction can access files outside the intended directory, exposing application code, configuration data, or other sensitive resources on the OpenEMR host.

Affected Products

OpenEMR versions prior to 7.3.0
OpenEMR Load Code feature component
Deployments running open-emr:openemr package

Discovery Timeline

2025-03-25 - CVE-2025-29789 published to NVD
2025-05-06 - Last updated in NVD database

Technical Details for CVE-2025-29789

Vulnerability Analysis

The vulnerability resides in OpenEMR's Load Code feature, where user-controllable input is incorporated into a file path without adequate normalization or allow-list validation. Because the affected code path accepts relative path sequences such as ../, an authenticated operator can reference files outside the intended directory tree. The reachable functionality requires elevated privileges within the OpenEMR application, narrowing the attacker population to insiders or accounts already compromised through other means.

The issue affects all OpenEMR releases before 7.3.0. The vendor's patch in commit ef3bb7f84ebe8ef54d55416e587ec2fefd065489 modifies interface/super/layout_listitems_ajax.php and related logic to harden the affected endpoint. The change observed in the upstream commit also sets an explicit Content-Type: text/javascript response header to reduce XSS risk in the same code path.

Root Cause

The root cause is insufficient input validation on a path parameter passed to the Load Code feature. The handler concatenates attacker-influenced input into a file system path without canonicalizing the result or constraining it to a designated base directory. This pattern matches [CWE-23], where relative traversal sequences are not stripped before file resolution.

Attack Vector

Exploitation requires network access to the OpenEMR web interface, authentication as a high-privileged user, and user interaction. An attacker submits a crafted request to the Load Code endpoint containing directory traversal sequences in the targeted parameter. The application resolves the manipulated path and returns or processes a file outside the intended directory, leading to limited confidentiality impact on the affected installation.

php

// Patch excerpt from interface/super/layout_listitems_ajax.php
 $res = sqlStatement("SELECT option_id FROM list_options WHERE list_id = ? AND activity = 1 " .
   "ORDER BY seq, option_id", array($listid));
 
+// Set content type to mitigate xss
+header('Content-Type: text/javascript');
 echo "var itemsel = document.forms[0][" . js_escape($target) . "];\n";
 echo "var j = 0;\n";
 echo "itemsel.options[j++] = new Option(" . js_escape("-- " . xl('Please Select') . " --") . ",'',false,false);\n";

Source: OpenEMR commit ef3bb7f. This patch hardens the affected AJAX handler associated with the Load Code feature.

Detection Methods for CVE-2025-29789

Indicators of Compromise

HTTP requests to OpenEMR endpoints containing ../, ..%2f, or URL-encoded traversal sequences in path or filename parameters.
Access log entries showing the Load Code feature being invoked with unusual file references outside the application's standard directories.
Read access in web server logs to files such as sqlconf.php, /etc/passwd, or other paths not normally served by the OpenEMR application.

Detection Strategies

Inspect web server and PHP-FPM logs for requests targeting interface/super/layout_listitems_ajax.php and adjacent Load Code handlers with suspicious path parameters.
Deploy web application firewall rules that flag traversal patterns (../, encoded variants) submitted to authenticated OpenEMR endpoints.
Correlate elevated-privilege account activity with file access anomalies on the host running OpenEMR.

Monitoring Recommendations

Enable verbose audit logging for OpenEMR administrative accounts and review usage of code customization features.
Monitor file system reads from the PHP process for paths outside the OpenEMR webroot and configuration directories.
Alert on new or unexpected authentications to high-privilege OpenEMR roles, particularly from atypical IP ranges.

How to Mitigate CVE-2025-29789

Immediate Actions Required

Upgrade all OpenEMR instances to version 7.3.0 or later, which contains the official fix.
Audit administrator and high-privilege accounts within OpenEMR and rotate credentials where exposure is suspected.
Restrict network access to the OpenEMR administrative interface using VPN, IP allow-lists, or a reverse proxy with authentication.

Patch Information

The fix is delivered in OpenEMR 7.3.0. Upstream details are available in the GitHub Security Advisory GHSA-ffpq-2wqj-v8ff and the corresponding code change in OpenEMR commit ef3bb7f.

Workarounds

If immediate upgrade is not feasible, restrict access to the Load Code feature by limiting which accounts hold administrative privileges in OpenEMR.
Place a web application firewall in front of OpenEMR with rules that block traversal payloads in query and POST parameters.
Run the OpenEMR PHP process under a least-privileged operating system account with file system permissions scoped to the application directory.

bash

# Example: verify installed OpenEMR version and apply upgrade
grep -R "v7\." /var/www/openemr/version.php
# Pull the patched release
cd /var/www/openemr
git fetch --tags
git checkout v7.3.0
# Reapply file permissions to the webroot
chown -R www-data:www-data /var/www/openemr
find /var/www/openemr -type d -exec chmod 750 {} \;
find /var/www/openemr -type f -exec chmod 640 {} \;